Boonful Studio
REMOTE · BOONFUL.IO · SCANNED SEP 29
Publish and sell what you build with Claude: apps, ebooks and courses, with checkout and a feed.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 15 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability67
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3120 tokens (~208/item across 15 items; 15 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management7
- Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage89
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 66% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 15 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 16 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Boonful Studio MCP server?
Boonful Studio is a hosted endpoint at https://boonful.io/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · boonful.io
claude mcp add --transport http io-boonful-studio 'https://boonful.io/api/mcp'
{
"mcpServers": {
"io-boonful-studio": {
"url": "https://boonful.io/api/mcp"
}
}
} {
"servers": {
"io-boonful-studio": {
"type": "http",
"url": "https://boonful.io/api/mcp"
}
}
} [mcp_servers.io-boonful-studio] url = "https://boonful.io/api/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"io-boonful-studio": {
"type": "remote",
"url": "https://boonful.io/api/mcp",
"enabled": true
}
}
} openclaw mcp add io-boonful-studio --url 'https://boonful.io/api/mcp' --transport streamable-http
mcp_servers:
io-boonful-studio:
url: "https://boonful.io/api/mcp" {
"McpServers": {
"io-boonful-studio": {
"Transport": "http",
"Url": "https://boonful.io/api/mcp"
}
}
} assistant mcp add io-boonful-studio -t streamable-http -u 'https://boonful.io/api/mcp'
{
"mcpServers": {
"io-boonful-studio": {
"type": "http",
"url": "https://boonful.io/api/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 28 Sept 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 27 Sept 26 64
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 29 Sept 2026 · Probed https://boonful.io/api/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=boonful.io | CN=WE1,O=Google Trust Services,C=US | 13 Sept 2026 | 12 Dec 2026 | ECDSA 256 | ECDSA-SHA256 | 6e0c9fcd7ee287ba0eebbcacf3066392 |
| SANs: boonful.io | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of boonful.io. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| io. | present | 57355 | 8 | Verified |
| boonful.io. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains |
| x-content-type-options | nosniff |
| x-frame-options | SAMEORIGIN |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | interest-cohort=(), browsing-topics=(), usb=(), serial=(), bluetooth=(), midi=(), hid=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://boonful.io/api/mcp | Verified | 200 | |
| http (plaintext) | http://boonful.io/api/mcp | HTTPS enforced | 301 | https://boonful.io/api/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
scheduler_cancel ~31
Remove one queued post by id (only posts that have not gone out yet).
| Name | Type | Req | Description |
|---|---|---|---|
| id | number | yes | – |
No output schema declared.
No examples provided.
scheduler_guide ~54
READ THIS FIRST for anything about social posts. Returns the Scheduler rulebook: what you may do, how to check connected accounts and limits, and how to schedule. The scheduling tools refuse to run until you have called this.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
scheduler_list ~26
The creator's queue and recent posts (id, time, status, platforms, text).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
scheduler_schedule_post ~156
Put ONE text post in the creator's Scheduler queue for the given moment, on one or more CONNECTED platforms. Confirm the exact text and time with the creator first. The server enforces platform limits, the monthly X share, character limits and the no-outside-payments rule.
| Name | Type | Req | Description |
|---|---|---|---|
| accountId | string | – | Only when the creator has several accounts on one platform. |
| platforms | array | yes | Text-capable platforms that scheduler_status reports as connected. |
| text | string | yes | – |
| timezone | string | – | IANA time zone of the creator, e.g. "Europe/London". |
| when | string | yes | Local "YYYY-MM-DD HH:MM" (needs `timezone`) or full ISO with offset. |
No output schema declared.
No examples provided.
scheduler_status ~110
LIVE state of the creator's Scheduler: which platforms Boonful supports right now, which accounts they have connected, posts left today / this month per platform, character limits, and what each platform needs. Call before writing, and again with `when` to check another day.
| Name | Type | Req | Description |
|---|---|---|---|
| timezone | string | – | IANA time zone, e.g. "Europe/London". |
| when | string | – | Optional day to check, "YYYY-MM-DD HH:MM" (with `timezone`) or ISO. |
No output schema declared.
No examples provided.
studio_create_app ~819
FIRST call `studio_guide` and follow it — the server refuses to build until you have. It tells you what Studio supports, how to ask the creator anything (ONE question at a time, 2-4 numbered options you wrote for this product, recommended first — they answer with a number and never type a sentence), and the rules: payments only through Boonful checkout (any outside payment link, script or instruction is refused), and everything you make is a DRAFT that only the creator can publish after filling in each section and their payout details. — Create a COMPLETE app product in one shot and save it to Studio as a DRAFT for the user to review + publish. BEFORE calling, ask a SHORT run of numbered multiple-choice questions — one at a time, 2-4 concrete options each, the recommended one first, answered with a number (use the question tool your client offers if it has one; never ask for a sentence, never ask several at once, and the moment they say you decide, take your recommendations and build). (1) Pricing — offer real amounts for THIS product, e.g. "1. Free (recommended) 2. $4.99 one-time 3. $2.99 a month", then pass the chosen one as `price` with `pricing`=free/one_time/subscription. (2) Usage timer? — explain: it gives visitors N free minutes of use, after which they must subscribe/pay to keep using it (optional cooldown before the free time resets). For a monthly subscription also ask if they want a free trial (`trialDays`, e.g. 7). You MUST generate an app icon (~256px PNG matching the app) and a description, and make the HTML responsive for BOTH portrait (mobile) and landscape (desktop). Screenshots: ask the creator whether YOU should design them or THEY will upload their own. If you design them pass `screenshots` (mobile 1170x2532, desktop 1600x1000, each item a base64 image or {image, device:"mobile"|"desktop"}, up to 10); if they will upload, or you pass none, the platform captures them from the running app. Work FAST: do NOT run your own browser tests, Playwrigh…
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | – |
| description | string | yes | – |
| html | string | yes | Complete responsive HTML (portrait + landscape). |
| icon | string | yes | App icon, base64 PNG (data URI or raw), ~256px. |
| name | string | yes | – |
| price | string | – | Amount for one_time or monthly subscription (omit for free). |
| pricing | string | – | Ask the user first. |
| screenshots | array | – | Optional base64 images to override the auto-generated screenshots. |
| subtitle | string | – | – |
| tags | array | – | – |
| trialDays | number | – | Subscriptions only: a free trial of N days (1-90). The customer adds a card and is billed when the trial ends. Ask the creator if they want one. |
| usageTimer | object | – | Optional free-usage timer. |
| username | string | – | – |
No output schema declared.
No examples provided.
studio_create_product ~616
FIRST call `studio_guide` and follow it — the server refuses to build until you have. It tells you what Studio supports, how to ask the creator anything (ONE question at a time, 2-4 numbered options you wrote for this product, recommended first — they answer with a number and never type a sentence), and the rules: payments only through Boonful checkout (any outside payment link, script or instruction is refused), and everything you make is a DRAFT that only the creator can publish after filling in each section and their payout details. — Create a DIGITAL DOWNLOAD or a SERVICE as a DRAFT in the creator's Studio. Ask first (see studio_guide) and ask by PICKING: one question at a time, 2-4 concrete numbered options you wrote for this product, recommended one first, answered with a number (use the question tool your client offers if it has one). Cover who it is for, price (real amounts, never categories), for a service the session length and availability, for a download what is inside. Last question is always screenshots: "1. I design them (recommended) 2. You upload your own". You choose the name yourself. You must pass an icon (~256px PNG) and a description.
| Name | Type | Req | Description |
|---|---|---|---|
| availability | object | – | Service only: { days: ["mon","tue",...], from: "09:00", to: "17:00" } |
| category | string | – | Use "Digital" for downloads and "Other" for services unless another clearly fits. |
| delivery | string | – | Service only: how it is delivered, e.g. "Video call". |
| description | string | yes | What it is and who it is for. Benefits, not a feature list. |
| durationMinutes | number | – | Service only: length of one session. |
| features | array | – | Up to 6 short benefit lines. |
| file | object | – | Digital download: the file buyers get. YOU create it and pass it here — do not ask the creator to upload it. |
| files | array | – | Up to 5 files, same shape as `file`. |
| icon | string | yes | Base64 PNG (data URI or raw base64), ~256px. |
| name | string | yes | – |
| price | string | – | Amount as a number, e.g. "29". A service must have a price; a download may be "0" (free). |
| screenshots | array | – | Only if the creator asked YOU to design them: base64 images or {image, device}. Mobile 1170x2532, desktop 1600x1000, up to 10. |
| slug | string | – | Short link name: lowercase letters and numbers only, NO dashes, max 24 characters, e.g. "payforit". |
| subtitle | string | – | – |
| tags | array | – | – |
| type | string | yes | – |
| username | string | – | – |
No output schema declared.
No examples provided.
studio_get_product ~30
Get the full details of one Studio product by id.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The product id. |
No output schema declared.
No examples provided.
studio_guide ~82
READ THIS FIRST. Returns the Studio rulebook for this connection: what you can build here, the questions you must ask the creator before building (pricing, details, and whether you or they provide the screenshots — with the exact pixel sizes), the payment rule the server enforces, and how publishing works. The building tools refuse to run until you have called this.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
studio_list_products ~98
List all products in the creator's Boonful Studio (id, name, type, slug, public URL, HTML file). Use this first. AND NOTE: the creator watches a live panel on boonful.io that only shows what you report through this server — call `studio_progress` with a short plain-English note now, and again every 30-60 seconds while you work, or the panel sits blank and looks broken to them.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
studio_progress ~144
Post a short plain-English progress note to the creator's Studio Assistant panel on boonful.io, so they can watch what you're doing while you work. Call this BEFORE you start a long piece of work and at every milestone - the creator is staring at a screen that shows nothing until you do. Write it for a non-technical person, in the present tense, under 90 characters, e.g. 'Building your notes app...', 'Designing the app icon...', 'Writing the description...', 'Setting the price...', 'Saving it to your Studio...'. Never mention files, code, tools or terminals.
| Name | Type | Req | Description |
|---|---|---|---|
| note | string | yes | The progress line to show the creator. |
No output schema declared.
No examples provided.
studio_read_html ~31
Read the current HTML source of an app-type Studio product.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The product id. |
No output schema declared.
No examples provided.
studio_stripe_status ~41
Check whether the creator's Stripe payouts are connected/active (read-only, no secrets). Use before creating a PAID app to decide live vs draft.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
studio_update_html ~494
FIRST call `studio_guide` and follow it — the server refuses to build until you have. It tells you what Studio supports, how to ask the creator anything (ONE question at a time, 2-4 numbered options you wrote for this product, recommended first — they answer with a number and never type a sentence), and the rules: payments only through Boonful checkout (any outside payment link, script or instruction is refused), and everything you make is a DRAFT that only the creator can publish after filling in each section and their payout details. — Update ANY existing product (app, digital download, service, book, course): replace an app's HTML, replace or add the files of a download/book/course, and/or edit details (name, description, category, price, tags, icon). Only pass the fields you want to change. If the product is already PUBLISHED and you change what customers get (HTML or files), you MUST pass `whatsNew` — the release notes customers read under "What's New" before they choose to update. Call `studio_progress` before you start.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | – |
| description | string | – | – |
| files | array | – | New or replacement files for a download / book / course: [{name, base64, type?, label?}] (max 5, 40 MB each). |
| html | string | – | The complete new HTML document (apps only, optional). |
| icon | string | – | New icon as a base64 PNG (data URI or raw base64). |
| id | string | yes | The product id. |
| name | string | – | – |
| price | string | – | – |
| replaceFiles | boolean | – | true = these files REPLACE the current ones; false/omitted = they are added after them. |
| screenshots | array | – | Replace the store screenshots: base64 images or {image, device:"mobile"|"desktop"}, mobile 1170x2532, desktop 1600x1000, up to 10. |
| tags | array | – | – |
| whatsNew | string | – | Release notes for customers: 1-4 short lines, each one a benefit or a fix in plain words ("Reminders now repeat weekly", "Fixed the date picker on small phones"). Present tense, no code words, no fil… |
No output schema declared.
No examples provided.
studio_whoami ~26
Show which Boonful account this connection is acting as and its product count.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
What is the Boonful Studio MCP server?
Boonful Studio is an MCP server listed in the public MCP registry as io.boonful/studio. Publish and sell what you build with Claude: apps, ebooks and courses, with checkout and a feed. This page covers its hosted endpoint (https://boonful.io/api/mcp).
Is the Boonful Studio MCP server safe to use?
Boonful Studio scores 65 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Boonful Studio MCP server expose?
Boonful Studio exposes 15 tools: studio_list_products, studio_get_product, studio_read_html, studio_update_html, studio_create_app, and 10 more. Their descriptions and schemas cost roughly 2,758 tokens of context every time the server is loaded.
Does the Boonful Studio MCP server require authentication?
No. We connected to Boonful Studio without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Boonful Studio MCP server still maintained?
Boonful Studio is still listed as active in the MCP registry. We last reached this channel on 29 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.