# Device Magic MCP by usefulapi (remote · device-magic.usefulapi.io)

Read Device Magic forms, submissions, devices and groups; send and revoke dispatches.

- Trust score: 63/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-25

## Components

- remote · `device-magic.usefulapi.io`: 63/100 (this document), [markdown](https://verifymcp.io/servers/io-usefulapi-device-magic/device-magic.md), [page](https://verifymcp.io/servers/io-usefulapi-device-magic/device-magic)

## Channel facts

- Endpoint: `https://device-magic.usefulapi.io/mcp`
- Transports: `streamable-http`
- Auth: `required`
- Version: `1.0.3`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-25.

- **Endpoint Security**: 78/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token.
  - HTTPS enforcement could not be verified: the plaintext port redirected somewhere other than https, so enforcement is unproven.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
  - The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents.
- **Transport & Reachability**: 0/100
  - Transport check failed: declared streamable-http, but the endpoint redirected instead of responding directly.
- **Schema Quality & AI Usability**: 85/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 1821 tokens (~107/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 3/100
  - Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### How do I install the Device Magic MCP by usefulapi server?

Device Magic MCP by usefulapi is a hosted endpoint at https://device-magic.usefulapi.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http io-usefulapi-device-magic 'https://device-magic.usefulapi.io/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "io-usefulapi-device-magic": {
      "url": "https://device-magic.usefulapi.io/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "io-usefulapi-device-magic": {
      "type": "http",
      "url": "https://device-magic.usefulapi.io/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.io-usefulapi-device-magic]
url = "https://device-magic.usefulapi.io/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-usefulapi-device-magic": {
      "type": "remote",
      "url": "https://device-magic.usefulapi.io/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add io-usefulapi-device-magic --url 'https://device-magic.usefulapi.io/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  io-usefulapi-device-magic:
    url: "https://device-magic.usefulapi.io/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "io-usefulapi-device-magic": {
      "Transport": "http",
      "Url": "https://device-magic.usefulapi.io/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add io-usefulapi-device-magic -t streamable-http -u 'https://device-magic.usefulapi.io/mcp'
```

### Other

```json
{
  "mcpServers": {
    "io-usefulapi-device-magic": {
      "type": "http",
      "url": "https://device-magic.usefulapi.io/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-25 (score 63, 0)

- [functional improvement] Stability: unverified → 0.03

### 2026-10-24 (score 63)

First indexed and scored.

## MCP tools (17)

### `devicemagic_list_forms` (~45 tokens)

List forms

List the organization's forms: id, namespace (the form's unique id used for dispatching), version, description and group. GET /organizations/{org}/forms.json.

### `devicemagic_get_form` (~94 tokens)

Get form definition

One form's definition: title and its questions/pages with identifiers and types (the identifiers are the keys inside submissions and dispatch payloads). Optionally a specific version. GET /organizations/{org}/forms/{id}.json.

Input parameters:

- `form_id` (integer, required): Form id (field `id` of list_forms).
- `version` (string): Form version such as 1.03; default = the latest.

### `devicemagic_list_submissions` (~193 tokens)

List form submissions

Submitted data of one form, newest data as stored in the form's Device Magic Database destination (it must be active on that form). Each record has form info, metadata (device, user, submitted_at, received_at, submission_id) and the answers. The reply says current_page, total_pages and total_count. Filter by from_date/to_date (yyyy-mm-dd). GET /api/forms/{id}/device_magic_database.json.

Input parameters:

- `form_id` (integer, required): Form id (field `id` of list_forms).
- `from_date` (string): Only submissions from this date (yyyy-mm-dd).
- `page` (integer): Page number, 1-based (use total_pages from the reply).
- `per_page` (integer): Submissions per page, 1-100 (default 25).
- `to_date` (string): Only submissions up to this date (yyyy-mm-dd).

### `devicemagic_list_devices` (~48 tokens)

List devices

List the organization's devices (phones, tablets, web-form users): id, identifier, owner, description, group and whether approval is pending. GET /organizations/{org}/devices.json.

### `devicemagic_get_device` (~62 tokens)

Get device

One device: id, identifier, owner, description, pending_approval, groups and custom attributes. GET /organizations/{org}/devices/{id}.json.

Input parameters:

- `device_id` (integer, required): Numeric device id (field `id` of list_devices).

### `devicemagic_list_groups` (~107 tokens)

List groups

List the organization's groups (which devices see which forms), optionally narrowed by a name filter or by tags. GET /api/v2/organizations/{org}/groups.json.

Input parameters:

- `filter` (string): Group name to look for, e.g. Default (the vendor matches part of the name).
- `page` (integer): Page number, 1-based (default 1).
- `tags` (array): Only groups having any of these tags (the vendor matches any tag).

### `devicemagic_list_resources` (~39 tokens)

List resources

List the organization's resources (lookup tables and files used by forms): id, original filename, version, description. GET /api/resources.json.

### `devicemagic_describe_resource` (~66 tokens)

Describe resource

Metadata of one resource: status, version and, for spreadsheets, its tables and columns. The file content itself is not downloaded. GET /api/resources/{id}/describe.json.

Input parameters:

- `resource_id` (integer, required): Resource id (field `id` of list_resources).

### `devicemagic_list_destinations` (~71 tokens)

List form destinations

List where one form's submissions are sent (e-mail, Dropbox, database, ...): id, active flag, format and transport types, timestamps. GET /api/forms/{id}/destinations.json.

Input parameters:

- `form_id` (integer, required): Form id (field `id` of list_forms).

### `devicemagic_get_destination` (~71 tokens)

Get form destination

One destination of a form. Credentials and tokens of the destination are never returned. GET /api/forms/{form_id}/destinations/{id}.json.

Input parameters:

- `destination_id` (integer, required): Destination id (field `id` of list_destinations).
- `form_id` (integer, required): Form id.

### `devicemagic_list_dispatches` (~65 tokens)

List outstanding dispatches

Outstanding dispatches (prefilled forms pushed to devices and not yet completed) of the whole organization: id, form name and namespace, device, scheduled time. Dispatch is an Enterprise-plan feature. GET /api/v2/organizations/{org}/dispatches.json.

### `devicemagic_list_device_dispatches` (~64 tokens)

List a device's outstanding dispatches

Outstanding dispatches of one device. GET /api/v2/devices/{identifier}/dispatches.json.

Input parameters:

- `device_identifier` (string, required): Device identifier (field `identifier` of a device, e.g. iPhone_abcdef1234567890).

### `devicemagic_get_dispatch` (~95 tokens)

Get dispatch with prefilled values

One dispatch of a device including the values it was prefilled with. GET /api/v3/devices/{identifier}/dispatches/{id}.json?include_inputs=true.

Input parameters:

- `device_identifier` (string, required): Device identifier (field `identifier` of a device, e.g. iPhone_abcdef1234567890).
- `dispatch_id` (integer, required): Dispatch id (field `id` of a dispatch list).

### `devicemagic_list_dispatch_recipients` (~78 tokens)

List dispatch recipients

Devices and web-forms users a dispatch can be sent to (first 100 by default; use items and page for more). GET /api/v3/dispatch_authors.json.

Input parameters:

- `items` (integer): Results per page (default 100).
- `page` (integer): Page number, 1-based.

### `devicemagic_send_dispatch` (~264 tokens)

Send a form to a device (dispatch)

WRITE: pushes a form, optionally prefilled, to one device where its user will see it (like assigning a job). Not idempotent: calling it twice sends two dispatches. Needs the Enterprise plan. The form is named by its namespace (list_forms); `payload` maps question identifiers (get_form) to prefilled values (subforms = nested objects, repeat groups = arrays). POST /api/v2/devices/{identifier}/dispatches.json.

Input parameters:

- `confirm` (boolean, required): Must be true: you confirm the form is sent to this device now (its user sees it).
- `device_identifier` (string, required): Device identifier (field `identifier` of a device, e.g. iPhone_abcdef1234567890).
- `form_description` (string): Description shown to the device user (Device Magic allows at most 255 characters).
- `form_name` (string): Title shown to the device user.
- `form_namespace` (string, required): Form namespace (field `namespace` of list_forms).
- `payload` (object): Prefilled values keyed by question identifier.
- `scheduled_at` (string): When the dispatch becomes due, ISO 8601 such as 2026-11-02T09:00:00Z.

### `devicemagic_revoke_dispatch` (~126 tokens)

Revoke a dispatch

WRITE: withdraws one outstanding dispatch from a device (the form disappears from the device). It cannot be undone, but the dispatch can be sent again. DELETE /api/v2/devices/{identifier}/dispatches/{id}.json.

Input parameters:

- `confirm` (boolean, required): Must be true: you confirm the dispatch is withdrawn from the device.
- `device_identifier` (string, required): Device identifier (field `identifier` of a device, e.g. iPhone_abcdef1234567890).
- `dispatch_id` (integer, required): Dispatch id (from list_device_dispatches).

### `devicemagic_approve_device` (~75 tokens)

Approve a pending device

WRITE: approves a device that is waiting for approval (pending_approval is true) so it can receive forms. Approving an approved device has no effect. POST /organizations/{org}/devices/{id}/approve.

Input parameters:

- `device_id` (integer, required): Numeric device id (field `id` of list_devices).

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/io-usefulapi-device-magic/device-magic#diagnostics

## Score history

- 2026-10-25: 63
- 2026-10-24: 63

## Common questions

### What is the Device Magic MCP by usefulapi server?

Device Magic MCP by usefulapi is listed in the public MCP registry as io.usefulapi/device-magic. Read Device Magic forms, submissions, devices and groups; send and revoke dispatches. This page covers its hosted endpoint (https://device-magic.usefulapi.io/mcp).

### Is the Device Magic MCP by usefulapi server safe to use?

Device Magic MCP by usefulapi scores 63 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Device Magic MCP by usefulapi server expose?

Device Magic MCP by usefulapi exposes 17 tools: devicemagic_list_forms, devicemagic_get_form, devicemagic_list_submissions, devicemagic_list_devices, devicemagic_get_device, and 12 more. Their descriptions and schemas cost roughly 1,563 tokens of context every time the server is loaded.

### Does the Device Magic MCP by usefulapi server require authentication?

Yes. Device Magic MCP by usefulapi asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

### Is the Device Magic MCP by usefulapi server still maintained?

Device Magic MCP by usefulapi is still listed as active in the MCP registry. We last reached this channel on 25 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://device-magic.usefulapi.io/mcp
- Repository: https://github.com/m190/usefulapi-mcp
- Website: https://usefulapi.io/device-magic/
- Changelog RSS feed: https://verifymcp.io/servers/io-usefulapi-device-magic/device-magic.xml
- Changelog JSON feed: https://verifymcp.io/servers/io-usefulapi-device-magic/device-magic.json
- HTML version of this page: https://verifymcp.io/servers/io-usefulapi-device-magic/device-magic