Device Magic MCP by usefulapi
REMOTE · DEVICE-MAGIC.USEFULAPI.IO
Read Device Magic forms, submissions, devices and groups; send and revoke dispatches.
Available components
Last scanned (4 hours ago)
Scores higher than 47% of remote servers
Reachable. Last reached 25 Oct 2026.
Category Workflow Automation
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security78
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS enforcement could not be verified: the plaintext port redirected somewhere other than https, so enforcement is unproven. View diagnostics → Unverified
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. View diagnostics → Partial
Transport & Reachability0
- Transport check failed: declared streamable-http, but the endpoint redirected instead of responding directly. See how to fix → View diagnostics → Fail
Schema Quality & AI Usability85
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 1821 tokens (~107/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management3
- Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 25 Oct 26 0
- Stability: unverified → 0.03 ▲ functional
- 24 Oct 26 63
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 25 Oct 2026 · Probed https://device-magic.usefulapi.io/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=usefulapi.io | CN=WE1,O=Google Trust Services,C=US | 13 Sept 2026 | 12 Dec 2026 | ECDSA 256 | ECDSA-SHA256 | d9be3287b0fde9630e825ba1f79bff3f |
| SANs: usefulapi.io, *.usefulapi.io | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of device-magic.usefulapi.io. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| io. | present | 38690, 57355 | 8, 8 | Verified |
| usefulapi.io. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 302 |
WWW-Authenticate challenge Bearer realm="OAuth", resource_metadata="https://device-magic.usefulapi.io/.well-known/oauth-protected-resource/mcp"
Bearer realm="OAuth", resource_metadata="https://device-magic.usefulapi.io/.well-known/oauth-protected-resource/mcp" Protected resource metadata
| Document | https://device-magic.usefulapi.io/.well-known/oauth-protected-resource/mcp |
|---|---|
| Retrieved | Yes |
| Resource | https://device-magic.usefulapi.io/mcp |
| Authorisation server | https://device-magic.usefulapi.io |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://device-magic.usefulapi.io/mcp | Redirected | 302 | https://usefulapi.io/device-magic/ |
| http (plaintext) | http://device-magic.usefulapi.io/mcp | Inconclusive | 302 | http://device-magic.usefulapi.io/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
devicemagic_approve_device Approve a pending device ~75
WRITE: approves a device that is waiting for approval (pending_approval is true) so it can receive forms. Approving an approved device has no effect. POST /organizations/{org}/devices/{id}/approve.
| Name | Type | Req | Description |
|---|---|---|---|
| device_id | integer | yes | Numeric device id (field `id` of list_devices). |
No output schema declared.
No examples provided.
devicemagic_describe_resource Describe resource ~66
Metadata of one resource: status, version and, for spreadsheets, its tables and columns. The file content itself is not downloaded. GET /api/resources/{id}/describe.json.
| Name | Type | Req | Description |
|---|---|---|---|
| resource_id | integer | yes | Resource id (field `id` of list_resources). |
No output schema declared.
No examples provided.
devicemagic_get_destination Get form destination ~71
One destination of a form. Credentials and tokens of the destination are never returned. GET /api/forms/{form_id}/destinations/{id}.json.
| Name | Type | Req | Description |
|---|---|---|---|
| destination_id | integer | yes | Destination id (field `id` of list_destinations). |
| form_id | integer | yes | Form id. |
No output schema declared.
No examples provided.
devicemagic_get_device Get device ~62
One device: id, identifier, owner, description, pending_approval, groups and custom attributes. GET /organizations/{org}/devices/{id}.json.
| Name | Type | Req | Description |
|---|---|---|---|
| device_id | integer | yes | Numeric device id (field `id` of list_devices). |
No output schema declared.
No examples provided.
devicemagic_get_dispatch Get dispatch with prefilled values ~95
One dispatch of a device including the values it was prefilled with. GET /api/v3/devices/{identifier}/dispatches/{id}.json?include_inputs=true.
| Name | Type | Req | Description |
|---|---|---|---|
| device_identifier | string | yes | Device identifier (field `identifier` of a device, e.g. iPhone_abcdef1234567890). |
| dispatch_id | integer | yes | Dispatch id (field `id` of a dispatch list). |
No output schema declared.
No examples provided.
devicemagic_get_form Get form definition ~94
One form's definition: title and its questions/pages with identifiers and types (the identifiers are the keys inside submissions and dispatch payloads). Optionally a specific version. GET /organizations/{org}/forms/{id}.json.
| Name | Type | Req | Description |
|---|---|---|---|
| form_id | integer | yes | Form id (field `id` of list_forms). |
| version | string | – | Form version such as 1.03; default = the latest. |
No output schema declared.
No examples provided.
devicemagic_list_destinations List form destinations ~71
List where one form's submissions are sent (e-mail, Dropbox, database, ...): id, active flag, format and transport types, timestamps. GET /api/forms/{id}/destinations.json.
| Name | Type | Req | Description |
|---|---|---|---|
| form_id | integer | yes | Form id (field `id` of list_forms). |
No output schema declared.
No examples provided.
devicemagic_list_device_dispatches List a device's outstanding dispatches ~64
Outstanding dispatches of one device. GET /api/v2/devices/{identifier}/dispatches.json.
| Name | Type | Req | Description |
|---|---|---|---|
| device_identifier | string | yes | Device identifier (field `identifier` of a device, e.g. iPhone_abcdef1234567890). |
No output schema declared.
No examples provided.
devicemagic_list_devices List devices ~48
List the organization's devices (phones, tablets, web-form users): id, identifier, owner, description, group and whether approval is pending. GET /organizations/{org}/devices.json.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
devicemagic_list_dispatch_recipients List dispatch recipients ~78
Devices and web-forms users a dispatch can be sent to (first 100 by default; use items and page for more). GET /api/v3/dispatch_authors.json.
| Name | Type | Req | Description |
|---|---|---|---|
| items | integer | – | Results per page (default 100). |
| page | integer | – | Page number, 1-based. |
No output schema declared.
No examples provided.
devicemagic_list_dispatches List outstanding dispatches ~65
Outstanding dispatches (prefilled forms pushed to devices and not yet completed) of the whole organization: id, form name and namespace, device, scheduled time. Dispatch is an Enterprise-plan feature. GET /api/v2/organizations/{org}/dispatches.json.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
devicemagic_list_forms List forms ~45
List the organization's forms: id, namespace (the form's unique id used for dispatching), version, description and group. GET /organizations/{org}/forms.json.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
devicemagic_list_groups List groups ~107
List the organization's groups (which devices see which forms), optionally narrowed by a name filter or by tags. GET /api/v2/organizations/{org}/groups.json.
| Name | Type | Req | Description |
|---|---|---|---|
| filter | string | – | Group name to look for, e.g. Default (the vendor matches part of the name). |
| page | integer | – | Page number, 1-based (default 1). |
| tags | array | – | Only groups having any of these tags (the vendor matches any tag). |
No output schema declared.
No examples provided.
devicemagic_list_resources List resources ~39
List the organization's resources (lookup tables and files used by forms): id, original filename, version, description. GET /api/resources.json.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
devicemagic_list_submissions List form submissions ~193
Submitted data of one form, newest data as stored in the form's Device Magic Database destination (it must be active on that form). Each record has form info, metadata (device, user, submitted_at, received_at, submission_id) and the answers. The reply says current_page, total_pages and total_count. Filter by from_date/to_date (yyyy-mm-dd). GET /api/forms/{id}/device_magic_database.json.
| Name | Type | Req | Description |
|---|---|---|---|
| form_id | integer | yes | Form id (field `id` of list_forms). |
| from_date | string | – | Only submissions from this date (yyyy-mm-dd). |
| page | integer | – | Page number, 1-based (use total_pages from the reply). |
| per_page | integer | – | Submissions per page, 1-100 (default 25). |
| to_date | string | – | Only submissions up to this date (yyyy-mm-dd). |
No output schema declared.
No examples provided.
devicemagic_revoke_dispatch Revoke a dispatch ~126
WRITE: withdraws one outstanding dispatch from a device (the form disappears from the device). It cannot be undone, but the dispatch can be sent again. DELETE /api/v2/devices/{identifier}/dispatches/{id}.json.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Must be true: you confirm the dispatch is withdrawn from the device. |
| device_identifier | string | yes | Device identifier (field `identifier` of a device, e.g. iPhone_abcdef1234567890). |
| dispatch_id | integer | yes | Dispatch id (from list_device_dispatches). |
No output schema declared.
No examples provided.
devicemagic_send_dispatch Send a form to a device (dispatch) ~264
WRITE: pushes a form, optionally prefilled, to one device where its user will see it (like assigning a job). Not idempotent: calling it twice sends two dispatches. Needs the Enterprise plan. The form is named by its namespace (list_forms); `payload` maps question identifiers (get_form) to prefilled values (subforms = nested objects, repeat groups = arrays). POST /api/v2/devices/{identifier}/dispatches.json.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Must be true: you confirm the form is sent to this device now (its user sees it). |
| device_identifier | string | yes | Device identifier (field `identifier` of a device, e.g. iPhone_abcdef1234567890). |
| form_description | string | – | Description shown to the device user (Device Magic allows at most 255 characters). |
| form_name | string | – | Title shown to the device user. |
| form_namespace | string | yes | Form namespace (field `namespace` of list_forms). |
| payload | object | – | Prefilled values keyed by question identifier. |
| scheduled_at | string | – | When the dispatch becomes due, ISO 8601 such as 2026-11-02T09:00:00Z. |
No output schema declared.
No examples provided.
How do I install the Device Magic MCP by usefulapi server?
Device Magic MCP by usefulapi is a hosted endpoint at https://device-magic.usefulapi.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · device-magic.usefulapi.io
claude mcp add --transport http io-usefulapi-device-magic 'https://device-magic.usefulapi.io/mcp'
What is the Device Magic MCP by usefulapi server?
Device Magic MCP by usefulapi is listed in the public MCP registry as io.usefulapi/device-magic. Read Device Magic forms, submissions, devices and groups; send and revoke dispatches. This page covers its hosted endpoint (https://device-magic.usefulapi.io/mcp).
Is the Device Magic MCP by usefulapi server safe to use?
Device Magic MCP by usefulapi scores 63 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Device Magic MCP by usefulapi server expose?
Device Magic MCP by usefulapi exposes 17 tools: devicemagic_list_forms, devicemagic_get_form, devicemagic_list_submissions, devicemagic_list_devices, devicemagic_get_device, and 12 more. Their descriptions and schemas cost roughly 1,563 tokens of context every time the server is loaded.
Does the Device Magic MCP by usefulapi server require authentication?
Yes. Device Magic MCP by usefulapi asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the Device Magic MCP by usefulapi server still maintained?
Device Magic MCP by usefulapi is still listed as active in the MCP registry. We last reached this channel on 25 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.