io.usefulapi/depot
REMOTE · DEPOT.USEFULAPI.IO · SCANNED OCT 4
Inspect Depot builds, CI runs, job logs and Actions runners; retry or cancel CI runs.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security89
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. View diagnostics → Partial
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability74
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3166 tokens (~143/item across 22 items; 22 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management10
- Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 22 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 22 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
How do I install the io.usefulapi/depot MCP server?
io.usefulapi/depot is a hosted endpoint at https://depot.usefulapi.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · depot.usefulapi.io
claude mcp add --transport http io-usefulapi-depot 'https://depot.usefulapi.io/mcp'
{
"mcpServers": {
"io-usefulapi-depot": {
"url": "https://depot.usefulapi.io/mcp"
}
}
} {
"servers": {
"io-usefulapi-depot": {
"type": "http",
"url": "https://depot.usefulapi.io/mcp"
}
}
} [mcp_servers.io-usefulapi-depot] url = "https://depot.usefulapi.io/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"io-usefulapi-depot": {
"type": "remote",
"url": "https://depot.usefulapi.io/mcp",
"enabled": true
}
}
} openclaw mcp add io-usefulapi-depot --url 'https://depot.usefulapi.io/mcp' --transport streamable-http
mcp_servers:
io-usefulapi-depot:
url: "https://depot.usefulapi.io/mcp" {
"McpServers": {
"io-usefulapi-depot": {
"Transport": "http",
"Url": "https://depot.usefulapi.io/mcp"
}
}
} assistant mcp add io-usefulapi-depot -t streamable-http -u 'https://depot.usefulapi.io/mcp'
{
"mcpServers": {
"io-usefulapi-depot": {
"type": "http",
"url": "https://depot.usefulapi.io/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Oct 26 +1
- Stability: unverified → 0.03 ▲ functional
- Server version: 1.3.0 → 1.5.1 functional
- 1 Oct 26 +47
- Authorization: unverified → pass ▲ security
- HTTPS: unverified → pass ▲ security
- Injection markers: unverified → pass ▲ security
- First check of Judged manipulation: pass security
- First check of Authorization: partial security
- MCP protocol: unverified → fail ▼ functional
- Tool coverage: unverified → 100 ▲ functional
- First check of Schema quality: fail functional
- First check of Schema quality: excellent functional
- First check of Destructive annotations: pass functional
- First check of Schema quality: fail functional
- First check of Tool coverage: 100 functional
- 30 Sept 26 +10
- Transport: fail → pass ▲ security
- Authorization: Authorisation not fully verified: no authorisation is required to connect, but we couldn't read the whole tool list to see what that exposes. security
- 29 Sept 26 18
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Oct 2026 · Probed https://depot.usefulapi.io/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=usefulapi.io | CN=WE1,O=Google Trust Services,C=US | 13 Sept 2026 | 12 Dec 2026 | ECDSA 256 | ECDSA-SHA256 | d9be3287b0fde9630e825ba1f79bff3f |
| SANs: usefulapi.io, *.usefulapi.io | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of depot.usefulapi.io. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| io. | present | 57355 | 8 | Verified |
| usefulapi.io. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer realm="OAuth", resource_metadata="https://depot.usefulapi.io/.well-known/oauth-protected-resource/mcp"
Bearer realm="OAuth", resource_metadata="https://depot.usefulapi.io/.well-known/oauth-protected-resource/mcp"Protected resource metadata
| Document | https://depot.usefulapi.io/.well-known/oauth-protected-resource/mcp |
|---|---|
| Retrieved | Yes |
| Resource | https://depot.usefulapi.io/mcp |
| Authorisation server | https://depot.usefulapi.io |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://depot.usefulapi.io/mcp | Verified | 200 | |
| http (plaintext) | http://depot.usefulapi.io/mcp | HTTPS enforced | 301 | https://depot.usefulapi.io/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
depot_ci_cancel_run Cancel a CI run ~76
WRITE — stops work in progress. Cancel a queued or running Depot CI run and all of its unfinished workflows, jobs and attempts. Cancelled jobs can be retried afterwards with depot_ci_retry_failed_jobs. Depot: CIService/CancelRun.
| Name | Type | Req | Description |
|---|---|---|---|
| run_id | string | yes | CI run id, from depot_ci_list_runs. |
No output schema declared.
No examples provided.
depot_ci_get_failure_diagnosis Diagnose a CI failure ~109
Get Depot's failure diagnosis for a CI run, workflow, job or attempt. For runs and workflows, identical failures are grouped by error fingerprint; for a job or attempt it is a focused diagnosis with evidence. Empty when no failure evidence is found. The best first call when a run failed. Depot: CIService/GetFailureDiagnosis.
| Name | Type | Req | Description |
|---|---|---|---|
| target_id | string | yes | The run, workflow, job or attempt id. |
| target_type | string | yes | What target_id identifies. |
No output schema declared.
No examples provided.
depot_ci_get_job Get a CI job ~75
Get one Depot CI job: status, conclusion, error message, timestamps, runner config (labels, image, CPUs, memory), matrix values, parent run/workflow context, dependencies and attempt history. Depot: CIService/GetJob.
| Name | Type | Req | Description |
|---|---|---|---|
| job_id | string | yes | CI job id, from depot_ci_get_run_status. |
No output schema declared.
No examples provided.
depot_ci_get_job_logs Get a CI job's logs ~132
Get persisted log lines for a Depot CI job attempt, oldest first (step key/name, timestamp, line number, body). Pass job_id to read the job's latest attempt, or attempt_id for a specific one — exactly one. Pass nextPageToken back as page_token for more lines. Depot: CIService/GetJobAttemptLogs.
| Name | Type | Req | Description |
|---|---|---|---|
| attempt_id | string | – | A specific attempt id. |
| job_id | string | – | CI job id — resolves to its latest attempt. |
| page_token | string | – | Cursor from the previous response's nextPageToken. Omit for the first page. |
No output schema declared.
No examples provided.
depot_ci_get_run_status Get a CI run's status tree ~84
Get a Depot CI run's status with its nested workflows, jobs and attempts (ids, keys, statuses, error messages). This is how to find the workflowId / jobId / attemptId for the log, diagnosis and retry tools. Depot: CIService/GetRunStatus.
| Name | Type | Req | Description |
|---|---|---|---|
| run_id | string | yes | CI run id, from depot_ci_list_runs. |
No output schema declared.
No examples provided.
depot_ci_list_runs List Depot CI runs ~193
List Depot CI runs, newest first. Filter by status (default: running + queued — pass ["failed"] to find failures), repo, commit SHA prefix, trigger event, or pull request number (requires repo). Depot: CIService/ListRuns.
| Name | Type | Req | Description |
|---|---|---|---|
| page_size | integer | – | Page size, 1-100. |
| page_token | string | – | Cursor from the previous response's nextPageToken. Omit for the first page. |
| pr | string | – | Pull request number. Requires repo. |
| repo | string | – | Repository in owner/name format, e.g. depot/cli. |
| sha | string | – | Commit SHA prefix (1-40 hex chars). |
| status | array | – | Run statuses to include (ORed). Default on Depot's side: running and queued. |
| trigger | string | – | Trigger event, e.g. push, pull_request, schedule, workflow_dispatch. |
No output schema declared.
No examples provided.
depot_ci_list_workflows List Depot CI workflows ~154
List Depot CI workflows across runs, newest first, with per-status job counts. Filter by name/path text, repo, status, trigger, SHA prefix or PR number. Depot: CIService/ListWorkflows.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | Text to match in the workflow name or file path. |
| page_size | integer | – | Page size, 1-200. |
| pr | string | – | Pull request number. |
| repo | string | – | Repository in owner/name format. |
| sha | string | – | Commit SHA prefix (1-40 hex chars). |
| status | array | – | Workflow statuses to include (ORed). |
| trigger | string | – | Trigger event, e.g. push or pull_request. |
No output schema declared.
No examples provided.
depot_ci_retry_failed_jobs Retry a workflow's failed jobs ~76
WRITE — starts compute. Retry only the failed and cancelled jobs in a Depot CI workflow, plus skipped jobs that depend on them. Jobs that succeeded are left alone. Depot: CIService/RetryFailedJobs.
| Name | Type | Req | Description |
|---|---|---|---|
| workflow_id | string | yes | Workflow id, from depot_ci_get_run_status or depot_ci_list_workflows. |
No output schema declared.
No examples provided.
depot_ci_retry_job Retry a CI job ~90
WRITE — starts compute. Retry one failed or cancelled Depot CI job, plus any skipped jobs that depend on it. Fails if a dependent job already started; use depot_ci_retry_failed_jobs then. Depot: CIService/RetryJob.
| Name | Type | Req | Description |
|---|---|---|---|
| job_id | string | yes | Job id to retry. |
| workflow_id | string | yes | Workflow id containing the job, from depot_ci_get_run_status. |
No output schema declared.
No examples provided.
depot_create_project Create a project ~260
WRITE. Create a Depot container-build project (an isolated build cache). Idempotent by name: if an active project with the same name exists, that project is returned. Defaults: cache 50 GB / 14 days, hardware HARDWARE_16X32 on AWS builders. Depot: ProjectService/CreateProject.
| Name | Type | Req | Description |
|---|---|---|---|
| build_timeout_minutes | integer | – | Max duration of each build, minutes. Omit for no timeout. |
| cache_keep_days | integer | – | Days to keep cache entries since last use (1-30). Default 14. |
| cache_keep_gb | integer | – | Max cache size per architecture, GB (25-1000). Default 50. |
| hardware | string | – | Builder size, e.g. HARDWARE_16X32 (16 CPU / 32 GB). |
| max_concurrent_builds | integer | – | Builds per builder before autoscaling adds one. Omit to disable autoscaling. |
| name | string | yes | Display name for the project. |
| organization_id | string | – | Owning organization. Only needed for user tokens that belong to more than one org. |
| region_id | string | yes | Depot region or cloud connection, e.g. us-east-1 or eu-central-1. |
No output schema declared.
No examples provided.
depot_get_build Get a build ~53
Get one container build's status, timestamps, duration, time saved and cached/total step counts. Depot: core BuildService/GetBuild.
| Name | Type | Req | Description |
|---|---|---|---|
| build_id | string | yes | Build id, from depot_list_builds. |
No output schema declared.
No examples provided.
depot_get_build_step_logs Get a build step's logs ~130
Get the log lines (message + timestamp) of one container-build step, identified by its digest from depot_get_build_steps. Depot: build.v1 BuildService/GetBuildStepLogs.
| Name | Type | Req | Description |
|---|---|---|---|
| build_id | string | yes | Build id. |
| page_size | integer | – | Page size, 1-1000. |
| page_token | string | – | Cursor from the previous response's nextPageToken. Omit for the first page. |
| project_id | string | yes | Project id the build belongs to. |
| step_digest | string | yes | The step's digest, from depot_get_build_steps. |
No output schema declared.
No examples provided.
depot_get_build_steps List a build's steps ~144
List the BuildKit steps of a container build: name, digest, start/end time, cache state (CACHED / UNCACHED), any error, and whether it has logs. Find the failing step here, then pass its digest to depot_get_build_step_logs. Depot: build.v1 BuildService/GetBuildSteps.
| Name | Type | Req | Description |
|---|---|---|---|
| build_id | string | yes | Build id, from depot_list_builds. |
| page_size | integer | – | Page size, 1-1000. |
| page_token | string | – | Cursor from the previous response's nextPageToken. Omit for the first page. |
| project_id | string | yes | Project id the build belongs to. |
No output schema declared.
No examples provided.
depot_get_project Get a project ~52
Get one Depot project — name, region, hardware size, cache policy, build timeout and autoscaling. Depot: ProjectService/GetProject.
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | Project id, from depot_list_projects. |
No output schema declared.
No examples provided.
depot_get_usage Get organization usage ~128
Get the organization's Depot usage over a window: container builds per project (build count, minutes saved, minutes billed), GitHub Actions jobs per repo/workflow/runner (minutes elapsed and billed), storage, and agent sandboxes. Depot: UsageService/GetUsage.
| Name | Type | Req | Description |
|---|---|---|---|
| end_at | string | yes | Window end, RFC 3339 (e.g. 2026-09-30T00:00:00Z). |
| start_at | string | yes | Window start, RFC 3339 (e.g. 2026-09-01T00:00:00Z). |
No output schema declared.
No examples provided.
depot_gha_get_analytics Get GitHub Actions analytics ~254
Get time-bucketed GitHub Actions analytics for Depot runners: job counts (successful/failed/cancelled), failure rate, elapsed and billable seconds, average duration — as totals plus hourly or daily buckets. Defaults to the last 30 days (max 90). Depot: GithubActionsService/GetGithubActionsAnalytics.
| Name | Type | Req | Description |
|---|---|---|---|
| aggregation_unit | string | – | Bucket size. Default: day. |
| end_at | string | – | Window end, RFC 3339 (e.g. 2026-09-18T00:00:00Z). |
| jobs | array | – | Job display names to include. |
| repositories | array | – | Connected repositories in owner/name format, e.g. ["acme/widgets"]. Empty = all. |
| runner_labels | array | – | Runner labels to include, e.g. depot-ubuntu-24.04-8. |
| start_at | string | – | Window start, RFC 3339 (e.g. 2026-09-17T00:00:00Z). |
| workflow_paths | array | – | Workflow file paths to include, e.g. .github/workflows/ci.yml. |
| workflows | array | – | Workflow names to include. |
No output schema declared.
No examples provided.
depot_gha_list_jobs List GitHub Actions jobs on Depot runners ~271
List GitHub Actions jobs that ran on Depot-managed runners, newest first: status, conclusion, runner label, requested CPU/memory, duration, billable time and GitHub URL. Defaults to the last 30 days (max window 90 days). Depot: GithubActionsService/ListGithubActionsJobs.
| Name | Type | Req | Description |
|---|---|---|---|
| conclusions | array | – | Job conclusions to include, e.g. ["failure"]. |
| end_at | string | – | Window end, RFC 3339 (e.g. 2026-09-18T00:00:00Z). |
| page_size | integer | – | Page size, 1-250. |
| page_token | string | – | Cursor from the previous response's nextPageToken. Omit for the first page. |
| query | string | – | Case-insensitive text matched against job and workflow names; numeric values also match exact GitHub job/run ids. |
| repositories | array | – | Connected repositories in owner/name format, e.g. ["acme/widgets"]. Empty = all. |
| runner_labels | array | – | Runner labels to include. |
| start_at | string | – | Window start, RFC 3339 (e.g. 2026-09-17T00:00:00Z). |
| statuses | array | – | Job states to include. |
No output schema declared.
No examples provided.
depot_gha_list_recommendations List runner-size recommendations ~281
List Depot's runner-size recommendations from job CPU and memory metrics: SIZE_UP when average CPU or memory reaches 90%, SIZE_DOWN when both averages stay ≤30% and peaks ≤70%, with current vs suggested size and per-minute price. Defaults to the last 30 days. Depot: GithubActionsService/ListGithubActionsRecommendations.
| Name | Type | Req | Description |
|---|---|---|---|
| end_at | string | – | Window end, RFC 3339 (e.g. 2026-09-18T00:00:00Z). |
| jobs | array | – | Job display names to include. |
| page_size | integer | – | Page size, 1-250. |
| page_token | string | – | Cursor from the previous response's nextPageToken. Omit for the first page. |
| repositories | array | – | Connected repositories in owner/name format, e.g. ["acme/widgets"]. Empty = all. |
| runner_labels | array | – | Runner labels to include, e.g. depot-ubuntu-24.04-8. |
| start_at | string | – | Window start, RFC 3339 (e.g. 2026-09-17T00:00:00Z). |
| workflow_paths | array | – | Workflow file paths to include, e.g. .github/workflows/ci.yml. |
| workflows | array | – | Workflow names to include. |
No output schema declared.
No examples provided.
depot_gha_search_logs Search GitHub Actions logs ~283
Search GitHub Actions log lines from Depot runners, newest match first (job, workflow, step, timestamp, body, lineId). Defaults to the last hour (max window 30 days). Filter by repository, workflow, runner label, action or compute id. Depot: GithubActionsService/SearchGithubActionsLogs.
| Name | Type | Req | Description |
|---|---|---|---|
| actions | array | – | Actions to include, e.g. actions/checkout. |
| compute_id | string | – | A single Depot compute id. |
| end_at | string | – | Window end, RFC 3339 (e.g. 2026-09-18T00:00:00Z). |
| page_size | integer | – | Page size, 1-1000. |
| page_token | string | – | Cursor from the previous response's nextPageToken. Omit for the first page. |
| query | string | – | Text to match in log bodies, e.g. "timeout". Empty returns unfiltered lines. |
| repositories | array | – | Connected repositories in owner/name format, e.g. ["acme/widgets"]. Empty = all. |
| runner_labels | array | – | Runner labels to include. |
| start_at | string | – | Window start, RFC 3339 (e.g. 2026-09-17T00:00:00Z). |
| workflows | array | – | Workflow names to include. |
No output schema declared.
No examples provided.
depot_list_builds List builds for a project ~114
List container builds in a project, newest first: status (STATUS_RUNNING / FAILED / SUCCESS / ERROR / CANCELED), timestamps, build duration, time saved by cache, and cached vs total steps. Depot: core BuildService/ListBuilds.
| Name | Type | Req | Description |
|---|---|---|---|
| page_size | integer | – | Page size, 1-100. |
| page_token | string | – | Cursor from the previous response's nextPageToken. Omit for the first page. |
| project_id | string | yes | Project id, from depot_list_projects. |
No output schema declared.
No examples provided.
depot_list_projects List projects ~113
List the organization's Depot projects. A project is an isolated container-build cache (region, hardware, cache policy). Use the returned projectId with the build and registry tools. Depot: ProjectService/ListProjects.
| Name | Type | Req | Description |
|---|---|---|---|
| page_size | integer | – | Page size, 1-250. |
| page_token | string | – | Cursor from the previous response's nextPageToken. Omit for the first page. |
| region_id | string | – | Only projects in this region or cloud connection, e.g. us-east-1. |
No output schema declared.
No examples provided.
depot_list_registry_images List registry images ~94
List the images stored in a project's Depot Registry: tag, digest, pushedAt and sizeBytes. Depot: build.v1 RegistryService/ListImages.
| Name | Type | Req | Description |
|---|---|---|---|
| page_size | integer | – | Page size, 1-100. |
| page_token | string | – | Cursor from the previous response's nextPageToken. Omit for the first page. |
| project_id | string | yes | Project id, from depot_list_projects. |
No output schema declared.
No examples provided.
What is the io.usefulapi/depot MCP server?
io.usefulapi/depot is an MCP server listed in the public MCP registry as io.usefulapi/depot. Inspect Depot builds, CI runs, job logs and Actions runners; retry or cancel CI runs. This page covers its hosted endpoint (https://depot.usefulapi.io/mcp).
Is the io.usefulapi/depot MCP server safe to use?
io.usefulapi/depot scores 77 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.usefulapi/depot MCP server expose?
io.usefulapi/depot exposes 22 tools: depot_list_projects, depot_get_project, depot_list_builds, depot_get_build, depot_get_build_steps, and 17 more. Their descriptions and schemas cost roughly 3,166 tokens of context every time the server is loaded.
Does the io.usefulapi/depot MCP server require authentication?
Yes. io.usefulapi/depot asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the io.usefulapi/depot MCP server still maintained?
io.usefulapi/depot is still listed as active in the MCP registry. We last reached this channel on 4 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.