Plain Insurance
REMOTE · APP.PLAIN.INSURANCE
Business insurance quotes for Danish companies, active policies and unsigned offers for review.
Available components
Last scanned (7 hours ago)
Scores higher than 61% of remote servers
Reachable. Last reached 5 Nov 2026.
Category Finance and Payments
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security83
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC is configured correctly; the domain's records validate against the full chain to the root. View diagnostics → Pass
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability66
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1714 tokens (~214/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management7
- Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage99
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 95% of tool parameters carry a description.Partial
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 8 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 8 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 4 Nov 26 0
- Tool “list_onboarding_catalog” rewrote its description, which is the text the model reads security
- Stability: unverified → 0.03 ▲ functional
- 3 Nov 26 73
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://app.plain.insurance/api/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=plain.insurance | CN=WE1,O=Google Trust Services,C=US | 20 Oct 2026 | 18 Jan 2027 | ECDSA 256 | ECDSA-SHA256 | 3e6e6e398f377e680e8d3535dd194543 |
| SANs: plain.insurance, *.plain.insurance | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC secure
Validation of app.plain.insurance. — Secure
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| insurance. | present | 32830 | 13 | Verified |
| plain.insurance. | present | 2371 | 13 | Verified |
| app.plain.insurance. | Verified address RRset verified with the apex keys |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://app.plain.insurance/api/mcp | Verified | 200 | |
| http (plaintext) | http://app.plain.insurance/api/mcp | HTTPS enforced | 301 | https://app.plain.insurance/api/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
create_onboarding Create unsigned insurance offers ~350
Recalculates an approved quote and creates offered, unsigned policies, ready for the customer to review and sign on Plain. Send the exact quote request again with its quoteId before expiresAt; offers are created for the products with status.value quoted only. Active insurance is rechecked before creation. Retry a failed request on the same connection with the same idempotency key and body. No insurance is accepted, activated or charged. When state.value is awaiting_verification, ask the person for the emailed code. Creates offers for the selected, authorized existing company without recreating it, or onboards a new company. For an existing company, select it with set_company_context and use its CVR; administrator access is required. Uses the connected user's identity: omit email and name. Requires signing in with onboarding:write consent; calling it prompts sign-in when needed. Check list_companies first. idempotencyKey is required. If the connected user's email is confirmed, no email code is needed. Do not reuse a retry key across reconnections; obtain a fresh quote after expiry or insurance changes.
| Name | Type | Req | Description |
|---|---|---|---|
| string | – | Email address of the person signing up; a verification code is sent here. | |
| idempotencyKey | string | – | Random key of 32-128 letters, digits, hyphens or underscores. Retry a failed request with the same key and body. |
| name | string | – | Full name of the person signing up. Must not contain links or markup. |
| quote | object | yes | The company, products and answers to price. Send the same object again in /start. |
| quoteId | string | yes | The `quoteId` of the quote the person approved. |
| Name | Type | Req | Description |
|---|---|---|---|
| capability | string | yes | Secret proof of this signup. Keep it private and send it with onboardingId. |
| continuationToken | – | – | Secret token for /payment-handoff, valid for 15 minutes after verification. |
| onboardingId | string | yes | Identifies this signup. |
| policyIds | array | yes | IDs of the offered policies, once created. |
| state | object | yes | awaiting_verification: ask the person for the emailed code; email_confirmed: call /verify-email again to finish; verified: offers are ready. |
No examples provided.
get_onboarding_payment_link Get the link to sign on Plain ~120
Returns a one-time link, valid for five minutes, where the person reviews the offers and sets up payment on Plain. The person must open and confirm it. Setting up payment does not accept the offers or charge money. Use the same authorized connection that created the offers and keep the target company selected; continuationToken may then be omitted.
| Name | Type | Req | Description |
|---|---|---|---|
| capability | string | yes | From the /start result. |
| continuationToken | string | – | The continuationToken from the /verify-email result. |
| onboardingId | string | yes | From the /start result. |
| Name | Type | Req | Description |
|---|---|---|---|
| expiresAt | string | yes | When the link expires (ISO 8601 date-time). |
| url | string | yes | One-time link to open in the person's browser. Valid for five minutes. |
No examples provided.
list_active_policies List active policies ~113
Requires signing in to Plain; calling it prompts sign-in when needed. Lists the active insurance policies for the currently selected Plain company on this connection, including product, carrier, dates, price and billing details. Amounts are in major currency units (e.g. DKK). totalPrice is the total price the customer pays; it is legally required to be split into the insurance premium and fees (statutory fees and taxes). Whenever you mention a price, state the total and its split into premium and fees.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| policies | array | yes | – |
No examples provided.
list_companies List permitted companies ~97
Requires signing in to Plain; calling it prompts sign-in when needed. Lists companies explicitly approved for this Plain connection that you still have access to, and marks the active company. Reports granted scopes and whether the connection can create unsigned offers. Check this before quoting for an existing company or offering to create offers. Reconnect requesting onboarding:write to approve offer creation, or reconnect to approve additional companies. Company permissions are checked separately when creating offers.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| canCreateOffers | boolean | yes | – |
| companies | array | yes | – |
| scopes | array | yes | – |
No examples provided.
list_onboarding_catalog List products and questions ~267
Lists the insurance products a Danish company can be offered and the questions to answer before quoting. Pass the company's CVR to resolve industry-specific questions and options. Use product slugs in `products` and question names as keys in `answers`. Employee FTE questions are listed as two whole-number questions, `<name>.fullTime` and `<name>.partTime`, each from 0 to 9999 inclusive; when required, send both counts, including zero. Numeric questions publish min/max limits when configured. Products with automaticQuote:false need manual review and list no questions. A product's requiredProducts must be selected with it; its questions include theirs. MultiSelect answers may be left out and default to an empty list. Enum fields use {value, label: {da, en}}; use value for logic and label for display. Read-only: nothing is created. Works without signing in. For an existing customer, call list_companies first and select the company with set_company_context. Use its CVR when collecting questions and quoting.
| Name | Type | Req | Description |
|---|---|---|---|
| cvr | string | – | Danish company registration number (CVR), eight digits, e.g. 39488914. |
| region | string | – | Market. Only Denmark (dk) is supported. Optional; defaults to dk. |
| Name | Type | Req | Description |
|---|---|---|---|
| errors | array | yes | Products that are listed but cannot currently be quoted, e.g. pricing_configuration. |
| productDependencies | array | yes | Products that require another product. |
| products | array | yes | Products that can be offered. |
No examples provided.
quote_onboarding_products Quote products ~604
Calculates indicative prices for up to twenty products for the company with this CVR, from one flat `answers` object. A plain key answers a question for the company and for every selected product that asks it; `<product>.<name>` answers one product's question. Stored answers and company discounts are not reused; supply required answers explicitly. An optional partnerCode applies that partner's discount. Enum fields use {value, label: {da, en}}. Each product has a status.value: only `quoted` products have a price; `contactPlain` products need an individual offer from Plain and `unavailable` ones cannot be offered (see `issue`). Prices are in DKK (major units) per billingFrequency.value period, with annualPrice for comparison and totals across products. State prices with each quote's `display` text in the customer's language, and always show the `disclaimer`. When pricePerEmployee is true, the price is per employee: say so using the quote's notice, as the customer selects the covered employees on Plain. Unknown answer keys are ignored and reported in warnings; required answers are never inferred. Nothing is bound, created or charged. Works without signing in, as a public new-company quote. Quotes for an existing customer must use the selected, authorized company's CVR. Active products return status.value alreadyInsured with no new-offer price and are excluded from totals and creation; held prerequisites do not need to be selected again. Check list_companies.canCreateOffers before promising to create offers. Quoting itself only needs policies:read. For existing companies, use get_onboarding_payment_link after creating offers for authenticated review; continueUrl is the public new-company signup page and does not apply private policy exclusions.
| Name | Type | Req | Description |
|---|---|---|---|
| answers | object | yes | Every answer in one object, keyed by the catalog question `name`. A plain name answers that question for the company and for every selected product that asks it; `<product>.<name>` (e.g. loesoerefors… |
| cvr | string | yes | Danish company registration number (CVR), eight digits, e.g. 39488914. |
| partnerCode | string | – | Optional partner discount code, 2-64 letters, digits, hyphens or underscores. Must be active. |
| products | array | yes | The products to quote: 1 to 20 distinct slugs, including any products they require. |
| region | string | – | Market. Only Denmark (dk) is supported. Optional; defaults to dk. |
| startDate | string | – | Policy start date (YYYY-MM-DD). Defaults to today. Must be between today and one year ahead. |
| Name | Type | Req | Description |
|---|---|---|---|
| continueUrl | string | yes | Where the customer reviews this quote on Plain and continues to sign up. Opening it creates nothing. |
| disclaimer | object | yes | Show with the prices: they are indicative, and nothing binds until the customer signs on Plain. |
| expiresAt | – | yes | Until when quoteId can be used for /start, unless prices change first; then request a new quote. |
| quoteId | string|null | yes | Identifies these prices; pass it as `quoteId` to /start with the exact original quote request. Only quoted products become offers. Null when no product is quoted. |
| quotes | array | yes | One quote per selected product, in request order. |
| startDate | string | yes | The insurance start date the prices apply to; today when the request has none. |
| totals | – | yes | Totals of the quoted products; null when no product is included. |
| warnings | array | – | Non-fatal problems with ignored answers. Omitted when there are none. |
No examples provided.
set_company_context Set active company ~65
Requires signing in to Plain. Changes the active Plain company for subsequent tool calls on this connection. Use an exact companyId from list_companies. All chats sharing this authorization share the selection. Already-running requests may finish for the previous company.
| Name | Type | Req | Description |
|---|---|---|---|
| companyId | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| companyId | string | yes | – |
| companyName | string | yes | – |
| isCurrent | boolean | yes | – |
No examples provided.
verify_onboarding_email Confirm the signup email ~98
Confirms the signup email with the eight-digit code the person received. Codes expire after 15 minutes and allow five attempts. Keep the returned capability and continuationToken private. Does not activate insurance.
| Name | Type | Req | Description |
|---|---|---|---|
| capability | string | yes | From the /start result. |
| code | string | yes | The eight-digit code from the verification email. Valid for 15 minutes, five attempts. |
| onboardingId | string | yes | From the /start result. |
| Name | Type | Req | Description |
|---|---|---|---|
| capability | string | yes | Secret proof of this signup. Keep it private and send it with onboardingId. |
| continuationToken | – | – | Secret token for /payment-handoff, valid for 15 minutes after verification. |
| onboardingId | string | yes | Identifies this signup. |
| policyIds | array | yes | IDs of the offered policies, once created. |
| state | object | yes | awaiting_verification: ask the person for the emailed code; email_confirmed: call /verify-email again to finish; verified: offers are ready. |
No examples provided.
How do I install the Plain Insurance MCP server?
Plain Insurance is a hosted endpoint at https://app.plain.insurance/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · app.plain.insurance
claude mcp add --transport http insurance-plain-mcp 'https://app.plain.insurance/api/mcp'
What is the Plain Insurance MCP server?
Plain Insurance is an MCP server listed in the public MCP registry as insurance.plain/mcp. Business insurance quotes for Danish companies, active policies and unsigned offers for review. This page covers its hosted endpoint (https://app.plain.insurance/api/mcp).
Is the Plain Insurance MCP server safe to use?
Plain Insurance scores 74 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Plain Insurance MCP server expose?
Plain Insurance exposes 8 tools: list_onboarding_catalog, quote_onboarding_products, create_onboarding, verify_onboarding_email, get_onboarding_payment_link, and 3 more. Their descriptions and schemas cost roughly 1,714 tokens of context every time the server is loaded.
Does the Plain Insurance MCP server require authentication?
No. We connected to Plain Insurance without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Plain Insurance MCP server still maintained?
Plain Insurance is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.