Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Scopeweb

REMOTE · MCP.SCOPEWEB.IO · SCANNED OCT 3

Suggest domain names for a concept, rank them, and confirm which are actually free.

Available components

+6 this week 79 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security78
  • The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
  • Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
  • HTTPS enforcement could not be verified: the plaintext port answered with HTTP 405, which proves neither a plaintext path nor enforcement. View diagnostics → Unverified
  • HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
  • DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
  • The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. View diagnostics → Partial
Transport & Reachability100
Schema Quality & AI Usability80
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 3500 tokens (~159/item across 22 items; 18 tools + 4 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management60
  • Stability observed for 18 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage85
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 54% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 18 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 20 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
  • Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Install

How do I install the Scopeweb MCP server?

Scopeweb is a hosted endpoint at https://mcp.scopeweb.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · mcp.scopeweb.io

# add to Claude Code
claude mcp add --transport http io-scopeweb-scopeweb 'https://mcp.scopeweb.io/mcp'
// .cursor/mcp.json
{
  "mcpServers": {
    "io-scopeweb-scopeweb": {
      "url": "https://mcp.scopeweb.io/mcp"
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "io-scopeweb-scopeweb": {
      "type": "http",
      "url": "https://mcp.scopeweb.io/mcp"
    }
  }
}
# ~/.codex/config.toml
[mcp_servers.io-scopeweb-scopeweb]
url = "https://mcp.scopeweb.io/mcp"
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-scopeweb-scopeweb": {
      "type": "remote",
      "url": "https://mcp.scopeweb.io/mcp",
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add io-scopeweb-scopeweb --url 'https://mcp.scopeweb.io/mcp' --transport streamable-http
# ~/.hermes/config.yaml
mcp_servers:
  io-scopeweb-scopeweb:
    url: "https://mcp.scopeweb.io/mcp"
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "io-scopeweb-scopeweb": {
      "Transport": "http",
      "Url": "https://mcp.scopeweb.io/mcp"
    }
  }
}
# add to Vellum
assistant mcp add io-scopeweb-scopeweb -t streamable-http -u 'https://mcp.scopeweb.io/mcp'
// mcp.json
{
  "mcpServers": {
    "io-scopeweb-scopeweb": {
      "type": "http",
      "url": "https://mcp.scopeweb.io/mcp"
    }
  }
}

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 2 Oct 26 +3
    • Schema quality: 180 → 159 ▲ functional
    • Schema quality: unverified → 100 ▲ functional
    • The server now declares the “prompts” capability functional
    • The server now declares the “resources” capability functional
    • New prompt “name_my_project” functional
    • New prompt “vet_a_name” functional
    • New prompt “what_will_this_cost” functional
    • New resource “How to read a Scopeweb answer” functional
    • New resource “The tool and endpoint specification” functional
    • New resource “What Scopeweb will and will not claim” functional
    • New resource “Wholesale pricing for every supported ending” functional
  • 1 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.

  • 29 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

  • 28 Sept 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 27 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

  • 25 Sept 26 +1
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 22 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

  • 20 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Oct 2026 · Probed https://mcp.scopeweb.io/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=scopeweb.io CN=WE1,O=Google Trust Services,C=US 20 Aug 2026 18 Nov 2026 ECDSA 256 ECDSA-SHA256 63a30f0d673702a113bb142bfd2d66ca
SANs: scopeweb.io, mcp.scopeweb.io, *.mcp.scopeweb.io
CN=WE1,O=Google Trust Services,C=US (CA) CN=GTS Root R4,O=Google Trust Services LLC,C=US 13 Dec 2023 20 Feb 2029 ECDSA 256 ECDSA-SHA384 7ff31977972c224a76155d13b6d685e3
CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE 15 Nov 2023 28 Jan 2028 ECDSA 384 SHA256-RSA 7fe530bf331343bedd821610493d8a1b

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of mcp.scopeweb.io. — Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
io. present 57355 8 Verified
scopeweb.io. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication Enforced and verified

The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.

Result Enforced and verified
Enforced On tool calls
HTTP status 200

WWW-Authenticate challenge Bearer realm="scopeweb", resource_metadata="https://mcp.scopeweb.io/.well-known/oauth-protected-resource"

Bearer realm="scopeweb", resource_metadata="https://mcp.scopeweb.io/.well-known/oauth-protected-resource"

Protected resource metadata

Document https://mcp.scopeweb.io/.well-known/oauth-protected-resource
Retrieved Yes
Resource https://mcp.scopeweb.io/mcp
Authorisation server https://api.scopeweb.io

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://mcp.scopeweb.io/mcp Verified 200
http (plaintext) http://mcp.scopeweb.io/mcp Inconclusive 405
MCP tools · 18 exposed · ~2,795 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
audit_domain ~100

Use this when the user asks what is wrong with a site they already own, or wants a name they hold assessed rather than a new one found. Fetch a live domain's observable surface: HTTP status, redirect target, title, meta description, h1 headings and tech hints. Read-only. Cannot spend money. Use to compare what is actually deployed against a spec, or to check whether a domain serves anything at all.

NameTypeReqDescription
domainstringyes–

No output schema declared.

No examples provided.

check_live ~268

⛔ THE LAST GATE, NOT THE FIRST STEP. Use this to CONFIRM a name immediately before acting on it, after suggest_names has generated candidates and score_name has ranked them. It answers only 'is this registered', and it will answer just as confidently for a list you invented as for one this service helped you build -- so a clean result here says nothing about whether the name is any good, or whether a better one sits next to it. If none of the names you pass have been seen by suggest_names or scan_namespace, the response says so and points you back. Use this immediately before you recommend buying anything, and any time an earlier answer said 'unknown', 'pending' or 'unprobed'. Those are never registration claims. Real-time authoritative registration check for up to 10 domains via RDAP. Read-only. Cannot spend money. This is the final gate before recommending a purchase — never rely on cached or older scan results for buying decisions. It answers whether a registration EXISTS, not whether the name can be bought or at what price: reserved and premium names return 404 here too. Registration-only: it does not fetch the site, so it returns 'registered' rather than 'active' or 'dormant'.

NameTypeReqDescription
domainsarrayyes–

No output schema declared.

No examples provided.

create_draft ~137

Use this when the user wants a page, site or landing draft for a name and there is nothing to edit yet. Store a draft website in the user's Scopeweb portfolio. Returns a persistent draft_id and a live preview_url. Drafts survive across conversations — use list_drafts in future sessions to resume work. Content is screened on every version; a flagged draft still returns normally here but its preview serves 451.

NameTypeReqDescription
descriptionstring–One paragraph on what this is
filesarrayyesSite files. index.html required for a browsable preview.
name_hintstring–Working name for the project

No output schema declared.

No examples provided.

fetch ~62

Everything we hold about one domain: whether it is registered, what it costs to claim AND what it renews at, and where each number came from. Pass a domain name as the id, for example "atlas.io".

NameTypeReqDescription
idstringyesA domain name.

No output schema declared.

No examples provided.

get_draft ~98

Use this before editing a draft you did not create in this conversation, so you are changing the text that actually exists rather than what you remember. Get a draft's metadata and file list, or a single file's content by passing path. Read-only. Cannot spend money. Use to resume work on a draft from a previous conversation.

NameTypeReqDescription
draft_idstringyes–
pathstring–Optional: return this file's content

No output schema declared.

No examples provided.

get_finance ~187

Use this before recommending anything with a price, so the numbers you quote are this account's real ones rather than list prices. The fiduciary readout for a project: the budget, per-domain renewal costs, total known carry, how many domains have UNKNOWN renewal costs, and the remaining headroom. Read-only. Cannot spend money. Read `carry_unknown_count` before quoting headroom to anyone: domains held at another registrar renew at that registrar's price list, which we cannot see, so their cost is reported as unknown with `reason: foreign_registrar_pricing` — never guessed, never zero. Where we can price a transfer to us, it appears as `alternative.transfer_in_price` and is explicitly NOT their renewal price. When `partial` is true, headroom is an UPPER BOUND and the true figure is lower.

NameTypeReqDescription
project_idstringyes–

No output schema declared.

No examples provided.

kb_search ~223

Use this to understand how something works before explaining it. Do NOT use it to decide anything: registry policy and registration status come from the dedicated tools, and they win. Semantic search over a small curated corpus: this system's own documentation and methodology, ICANN policy, and per-registry policy documents. Read-only. Cannot spend money. Returns passages with the source, its URL, and what that source may be cited FOR. THIS IS RETRIEVAL, NOT AUTHORITY. A vector search always returns its nearest neighbour, so it always looks confident; nearness is not correctness, and a passage being returned is not evidence that it answers you. Use it to understand how something works. Do NOT use it to decide anything: registry policy comes from GET /tld/:tld/policy, which carries per-field citations and marks unverified fields as unknown, and registration status comes from check_live via RDAP/WHOIS. If those two disagree with a passage here, they win.

NameTypeReqDescription
querystringyes–
top_kinteger––

No output schema declared.

No examples provided.

list_domains ~93

Use this at the start of any portfolio, renewal or 'what do I own' question, before assuming which names the user holds. List the user's domain inventory: every domain with a verification challenge issued or completed, plus cached liveness, classification, title and expiry. Read-only. Cannot spend money. Includes scan_age_ms so a stale verdict is never mistaken for a fresh one. Use before suggesting the user buy anything.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_drafts ~46

List all drafts in the user's Scopeweb portfolio with status, preview URLs and timestamps. Read-only. Cannot spend money. Call this at the start of a session to see existing work.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

quote_domain ~259

Use this when the user has chosen a name and wants the real price. It returns a confirm_url for the human to complete. It is NOT a purchase and you cannot make one. Get a real price for a name you believe is unregistered. Reads prices only. Cannot spend money — there is deliberately no tool in this server that can complete a purchase. Re-runs the authoritative gate first: a name that is registered, or whose status cannot be authoritatively determined, is never quoted. Returns total_cents, renewal_cents, an expiry, and a confirm_url. THE CONFIRM URL IS NOT A PURCHASE — it opens a page where a human must type the domain to authorise the charge. There is deliberately no tool to complete an order. An agent using this surface has no verb that spends, so nothing here needs obeying. Premium names are quoted at their real price or refused; they are never sold at the TLD base rate. An expired quote is re-quoted, never honoured.PRICES ARE IDENTICAL FOR ALL BUYERS REGARDLESS OF BUDGET — passing a project_id adds budget CONTEXT (does it fit, what is left after) and never changes the number.

NameTypeReqDescription
domainstringyes–

No output schema declared.

No examples provided.

scan_namespace ~72

Classify an explicit list of candidate domains (max 25). Read-only. Cannot spend money. Use suggest_names instead when you have a concept rather than a list. Returns registered, resolves, serves, parked, classification and liveness for each.

NameTypeReqDescription
candidatesarrayyesFull domain names, max 25.

No output schema declared.

No examples provided.

score_name ~247

Use this when the user is choosing between names, or asks whether a name is any good. Not for deciding availability, which is check_live. Grade candidate names on measurable properties of the string: length, syllables, pronounceability (the radio test), presence in a published English word list, edit distance to major brands, hyphens/digits, and TLD perception. Read-only. Cannot spend money. Every component returns its score, weight and basis so the number can be audited rather than trusted. Severe properties CAP the total instead of being averaged away — a name one edit from a major brand cannot score well however short it is. EXPLICITLY NOT a search-ranking prediction: exact-match-domain SEO value has been largely dead since Google's 2012 EMD update and nothing here forecasts how a name will rank. NOT a trademark search: brand_collision is string similarity to a published list, not legal clearance. Components that cannot be measured (zone rarity, trademark) are returned as unavailable with reasons and never estimated.

NameTypeReqDescription
domainstring–A single domain, e.g. 'forge.com'
domainsarray–Up to 10 domains; returned ranked best-first

No output schema declared.

No examples provided.

search ~72

Find domain names for an idea. Returns candidate names across every ending, each with the state we can defend: sellable, restricted, not ours to sell, taken, or not checked. Pass the concept, not a domain.

NameTypeReqDescription
querystringyesA word or an idea, for example "calm inbox".

No output schema declared.

No examples provided.

set_budget ~200

Use this when the user states a spending limit for a project. It records their ceiling; it never authorises a purchase. Set a monthly or yearly budget for a project, in cents. Records a number you chose. Cannot spend money and cannot buy anything. The response comes back with the project's CURRENT CARRY and HEADROOM already computed, because a budget with no carry beside it is a number rather than information. Headroom is flagged `partial` whenever the project contains a domain whose renewal price is unknown — a renewal we cannot price is counted as unknown, NEVER as zero, so headroom is an upper bound in that case and real headroom is lower.PRICES ARE IDENTICAL FOR ALL BUYERS REGARDLESS OF BUDGET. A budget changes what is recommended and how results are ordered; it never changes what anything costs.

NameTypeReqDescription
amount_centsintegeryes–
periodstringyes–
project_idstringyes–

No output schema declared.

No examples provided.

show_plans ~175

Use this when the user asks what a tier costs or bumps into a limit, so the answer is this account's actual plan rather than a guess. Show the available plans with what each includes, plus the caller's current tier and any allowance they have used. Read-only. Cannot spend money — it displays pricing and cannot start, change or cancel a subscription. Call this when a refusal names it as the recovery: an allowance is exhausted and the user is deciding what to do about it. PLANS GATE DEPTH, NEVER TRUTH — the registration verdict, its rdap_source and a domain's price are identical on every tier, and the response lists exactly what does not vary. Paying buys more of the picture, never a different answer about reality, so never present an upgrade as a way to get a better verdict.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

suggest_names ~335

★ START HERE when the user is choosing or inventing a name: it returns candidate names across a namespace. 'suggest names', 'help me name X', 'what should we call it', 'find me a domain for Y'. Give it a CONCEPT (a word or short phrase) and it generates and ranks candidates around it, classified by what is actually free. Read-only. Cannot spend money. (Renamed from browse_namespace on 2026-09-09: the old name described the mechanism, so assistants looking for a way to SUGGEST NAMES never matched it and invented candidates from their own heads instead.) Use scan_namespace instead when you already have an explicit list. Follow this with score_name to rank, and check_live LAST as the purchase gate. Re-querying the same scan_id walks deeper into the namespace and converges over about 3 calls. Unregistered does not mean purchasable: reserved and premium names answer the registry the same way. Only a registrar quote settles a price. PRICES ARE IDENTICAL FOR ALL BUYERS REGARDLESS OF BUDGET. A budget changes which candidates are recommended and how they are ordered; it never changes what anything costs.

NameTypeReqDescription
limitnumber–Candidates per page, max 50 (default 25)
offsetnumber–Walk deeper into the expansion
querystring–A word, name or idea, e.g. 'stowed'
scan_idstring–Resume a previous browse; replaces query/tlds
tldsarray–Defaults to com/io/ai/app/dev/co.

No output schema declared.

No examples provided.

update_draft ~104

Use this when a draft already exists and the user asks to change its copy, sections or layout. Call get_draft first if you do not have the current text. Update files in an existing draft. Acts as a patch: files you send are written as a new version, files you omit are carried forward unchanged. Previous versions are retained immutably. Returns the new version and preview_url.

NameTypeReqDescription
draft_idstringyes–
filesarrayyes–

No output schema declared.

No examples provided.

verify_ownership ~117

Use this when the user claims a domain is theirs and you are about to act on that claim. Ownership asserted in chat is not ownership; this is how it gets proven. Prove the user owns a domain via a DNS TXT challenge. action 'start' returns the TXT record to publish; action 'check' verifies it. Verification is required before a domain appears in list_domains. A failed DNS lookup returns an error, never 'not owned'.

NameTypeReqDescription
actionstring–Defaults to 'start'.
domainstringyes–

No output schema declared.

No examples provided.

Common questions

What is the Scopeweb MCP server?

Scopeweb is an MCP server listed in the public MCP registry as io.scopeweb/scopeweb. Suggest domain names for a concept, rank them, and confirm which are actually free. This page covers its hosted endpoint (https://mcp.scopeweb.io/mcp).

Is the Scopeweb MCP server safe to use?

Scopeweb scores 79 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Scopeweb MCP server expose?

Scopeweb exposes 18 tools: search, fetch, create_draft, update_draft, list_drafts, and 13 more. Their descriptions and schemas cost roughly 2,795 tokens of context every time the server is loaded.

Does the Scopeweb MCP server require authentication?

Yes. Scopeweb asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

Is the Scopeweb MCP server still maintained?

Scopeweb is still listed as active in the MCP registry. We last reached this channel on 3 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.