ModelsLab Agent Control Plane
REMOTE · MODELSLAB.COM
Account, billing, team, API key and model discovery tools for agents that use ModelsLab.
Available components
Last scanned (2 hours ago)
Scores higher than 71% of remote servers
Reachable. Last reached 24 Oct 2026.
Category AI and Machine Learning
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security60
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 8 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC is configured correctly; the domain's records validate against the full chain to the root. View diagnostics → Pass
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability77
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3479 tokens (~231/item across 15 items; 10 tools + 5 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management73
- Stability observed for 22 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 10 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 12 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 23 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 67 to 70. That category is still filling its 30-day observation window: 20 days of observed history at the previous scan, 21 at this one. The score rises as the window fills, whether or not the server changes.
- 21 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.
- 19 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Oct 26 +4
- DNSSEC: fail → pass ▲ security
- 4 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 24 Oct 2026 · Probed https://modelslab.com/mcp/agents
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=modelslab.com | CN=WE1,O=Google Trust Services,C=US | 13 Oct 2026 | 11 Jan 2027 | ECDSA 256 | ECDSA-SHA256 | 2a4212c7babc3f1a0ea67ea85809fa76 |
| SANs: modelslab.com, *.modelslab.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC secure
Validation of modelslab.com. — Secure
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| modelslab.com. | present | 2371 | 13 | Verified |
| modelslab.com. | Verified address RRset verified with the apex keys |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://modelslab.com/mcp/agents | Verified | 200 | |
| http (plaintext) | http://modelslab.com/mcp/agents | HTTPS enforced | 302 | https://modelslab.com/mcp/agents |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
agent-api-keys Agent API Key Management ~137
Manage API keys for the authenticated user. Actions: list, create, get, update, delete. API keys are used for generation endpoints (/api/v6, /api/v7, /api/v8). All actions require authentication.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | The API key action: list, create, get, update, delete |
| key_id | integer | – | API key ID (required for get, update, delete) |
| name | string | – | API key name (required for create, optional for update) |
| notes | string | – | Notes about the API key (optional for create, update) |
No output schema declared.
No examples provided.
agent-auth Agent Authentication ~264
Manage authentication for the ModelsLab agent control plane. Actions: signup, login, logout, logout-all, forgot-password, reset-password, resend-verification, verify. Login returns a bearer token for subsequent authenticated requests. Signup, login, forgot-password, reset-password, resend-verification, and verify do not require authentication.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | The auth action to perform: signup, login, logout, logout-all, forgot-password, reset-password, resend-verification, verify |
| device_name | string | – | Device name for the token (optional for login, default: "agent-control-plane") |
| string | – | Email address (required for signup, login, forgot-password, reset-password, resend-verification) | |
| name | string | – | User name (optional for signup) |
| password | string | – | Password (required for signup, login, reset-password) |
| password_confirmation | string | – | Password confirmation (required for reset-password) |
| token | string | – | Reset token (required for reset-password) |
| token_expiry | string | – | Token expiry: 1_week, 1_month (default), 3_months, never (optional for login) |
| verification_code | string | – | Email verification code (required for verify) |
No output schema declared.
No examples provided.
agent-billing Agent Billing Management ~597
Manage billing for the authenticated user. Actions: stripe-config (get Stripe publishable key for headless card tokenization), create-setup-intent (create SetupIntent for 3DS-safe card saving), create-payment-link (generate Stripe-hosted payment URL to forward to human — supports card, Google Pay, Amazon Pay, Link, etc.), overview, payment-methods, add-payment-method, set-default-payment-method, remove-payment-method, billing-info, update-billing-info, invoices, invoice-detail, invoice-pdf. Three payment paths: (1) Headless: stripe-config → tokenize → payment_method_id, (2) Human-assisted: create-payment-link → forward URL → poll confirm-checkout, (3) SetupIntent: create-setup-intent → confirm via Stripe → reuse payment method. All actions require authentication.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | The billing action: stripe-config, create-setup-intent, create-payment-link, overview, payment-methods, add-payment-method, set-default-payment-method, remove-payment-method, billing-info, update-bil… |
| address_city | string | – | City (for update-billing-info) |
| address_country | string | – | Country code (for update-billing-info) |
| address_line1 | string | – | Address line 1 (for update-billing-info) |
| address_line2 | string | – | Address line 2 (for update-billing-info) |
| address_postal_code | string | – | Postal/zip code (for update-billing-info) |
| address_state | string | – | State/province (for update-billing-info) |
| amount | number | – | Amount in USD, minimum $15 (required for create-payment-link with purpose=fund) |
| string | – | Billing email (for update-billing-info) | |
| idempotency_key | string | – | Idempotency key for mutation actions (optional — auto-generated if omitted for add-payment-method, update-billing-info) |
| invoice_id | string | – | Invoice ID (for invoice-detail, invoice-pdf) |
| make_default | boolean | – | Make the new payment method the default (for add-payment-method, default: true) |
| name | string | – | Billing name (for update-billing-info) |
| payment_method_id | string | – | Stripe payment method ID (for add/set-default/remove-payment-method) |
| plan_id | integer | – | Plan ID (required for create-payment-link with purpose=subscribe) |
| purpose | string | – | Payment link purpose: "fund" (wallet) or "subscribe" (subscription). Required for create-payment-link. |
| tax_id | string | – | Tax ID value (for update-billing-info) |
| tax_id_type | string | – | Tax ID type e.g. eu_vat, us_ein (required with tax_id) |
No output schema declared.
No examples provided.
agent-models Agent Model Discovery ~299
Search and discover AI models available on ModelsLab. Actions: search (browse/filter models), filters (available filter options), tags (model tags), providers (model providers), detail (get model details by ID). The detail action returns endpoint configurations with a `parameters` JSON Schema object describing each endpoint's accepted parameters (types, constraints, defaults) alongside the raw UI `config` array. Requires authentication.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | The models action: search, filters, tags, providers, detail |
| base_model | string | – | Filter by base model (for search) |
| feature | string | – | Filter by feature: imagen, video_fusion, audio_gen, llmaster, etc. (for search, tags) |
| model_id | string | – | Model ID (required for detail action) |
| model_subcategory | string | – | Filter by model subcategory (for search) |
| model_type | string | – | Filter by model type (for search) |
| per_page | integer | – | Results per page (for search, default: 20) |
| provider | string | – | Filter by provider name (for search) |
| search | string | – | Search query for model name/description (for search) |
| sort | string | – | Sort order: recommended, newest, popular (for search, default: recommended) |
| tags | string | – | Comma-separated tags to filter by (for search) |
No output schema declared.
No examples provided.
agent-profile Agent Profile Management ~281
Manage the authenticated user's profile. Actions: get (view profile), update (update name/username/about), update-password, update-socials, update-preferences. All actions require authentication.
| Name | Type | Req | Description |
|---|---|---|---|
| about_me | string | – | Bio/about text (for update) |
| action | string | yes | The profile action: get, update, update-password, update-socials, update-preferences |
| current_password | string | – | Current password (required for update-password) |
| discord | string | – | Discord handle (for update-socials) |
| string | – | Facebook URL (for update-socials) | |
| github | string | – | GitHub URL (for update-socials) |
| string | – | Instagram URL (for update-socials) | |
| name | string | – | Display name (for update) |
| nsfw_content | boolean | – | Enable NSFW content (for update-preferences) |
| password | string | – | New password (required for update-password) |
| password_confirmation | string | – | New password confirmation (required for update-password) |
| string | – | Twitter/X URL (for update-socials) | |
| username | string | – | Username (for update) |
| wallet_notification_enabled | boolean | – | Enable wallet notifications (for update-preferences) |
| wallet_notification_threshold | number | – | Wallet notification threshold amount (for update-preferences) |
No output schema declared.
No examples provided.
agent-subscriptions Agent Subscription Management ~384
Manage subscriptions for the authenticated user. Actions: list-plans (view available subscription plans + pay-as-you-go options), list, create (headless with payment_method_id, or checkout URL without it), confirm-checkout (confirm Stripe checkout session), status (check subscription status), update (change plan), pause, resume, reset-cycle, charge-amount (set paid model charge amount), fix-payment. Headless flow: get publishable key via agent-billing stripe-config → tokenize card via Stripe API → pass payment_method_id to create. All actions require authentication.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | The subscription action: list-plans, list, create, confirm-checkout, status, update, pause, resume, reset-cycle, charge-amount, fix-payment |
| amount | number | – | Charge amount in USD, $5-$10000 (required for charge-amount) |
| idempotency_key | string | – | Idempotency key for mutation actions (optional — auto-generated if omitted for create) |
| new_plan_id | integer | – | New plan ID to switch to (required for update) |
| payment_method_id | string | – | Stripe payment method ID for headless subscription (optional for create — if provided, charges immediately without checkout redirect) |
| plan_category | string | – | Plan category: "enterprise", or "imagen" for the standard ModelsLab subscription (optional for fix-payment; defaults to the subscription's own category) |
| plan_id | integer | – | Plan ID to subscribe to (required for create) |
| session_id | string | – | Stripe checkout session ID (required for confirm-checkout) |
| stripe_subscription_id | string | – | Stripe subscription ID (optional override for fix-payment) |
| subscription_id | integer | – | Subscription ID (required for update, pause, resume, reset-cycle, fix-payment) |
No output schema declared.
No examples provided.
agent-teams Agent Team Management ~194
Manage teams for the authenticated user. Actions: list (view team members and pending invites), create (invite by email), get (view a team member), update (modify member role/permissions), delete (remove member), resend-invite, accept-invite. All actions require authentication.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | The teams action: list, create, get, update, delete, resend-invite, accept-invite |
| string | – | Email address to invite (required for create) | |
| invite_id | string | – | Invite UUID (required for accept-invite) |
| invite_status | string | – | Invite status: pending, accepted (for update) |
| member_id | integer | – | Team member ID (required for get, update, delete, resend-invite) |
| permissions | array | – | Permissions array (for update) |
| role | string | – | Member role (for update) |
No output schema declared.
No examples provided.
agent-tokens Agent Token Management ~176
Manage Sanctum access tokens for the authenticated user. Actions: list (view all tokens), revoke (revoke a specific token by ID), revoke-others (revoke all tokens except current), switch-account (get a token for a team account). All actions require authentication.
| Name | Type | Req | Description |
|---|---|---|---|
| account_username | string | – | Username of the team account to switch to (required for switch-account) |
| action | string | yes | The token action: list, revoke, revoke-others, switch-account |
| device_name | string | – | Device name for new token (optional for switch-account) |
| token_expiry | string | – | Token expiry: 1_week, 1_month, 3_months, never (optional for switch-account) |
| token_id | integer | – | Token ID to revoke (required for revoke action) |
No output schema declared.
No examples provided.
agent-usage Agent Usage Analytics ~139
View API usage analytics for the authenticated user. Actions: summary (usage overview with plan limits), products (per-product usage breakdown), history (recent generation request timeline with optional date filters). All actions require authentication.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | The usage action: summary, products, history |
| from | string | – | Start date for history filter (YYYY-MM-DD format, optional for history) |
| limit | integer | – | Max number of history items to return (1-200, default 100, optional for history) |
| to | string | – | End date for history filter (YYYY-MM-DD format, optional for history) |
No output schema declared.
No examples provided.
agent-wallet Agent Wallet Operations ~397
Manage the wallet for the authenticated user. Actions: balance (view wallet balance), fund (add funds via Stripe payment), confirm-checkout (confirm a Stripe checkout session), payment-status (check payment intent status), auto-funding (configure auto-recharge), disable-auto-funding, withdraw (reseller only), validate-coupon, redeem-coupon. Fund with payment_method_id charges immediately; without it creates a Stripe checkout session. All actions require authentication.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | The wallet action: balance, fund, confirm-checkout, payment-status, auto-funding, disable-auto-funding, withdraw, validate-coupon, redeem-coupon |
| amount | number | – | Amount in USD, minimum $15 for fund (required for fund, withdraw) |
| auto_charge_amount | number | – | Auto charge amount, min $5 (required for auto-funding) |
| auto_recharge_amount | number | – | Auto recharge amount (optional for fund) |
| auto_recharge_threshold | number | – | Auto recharge threshold (optional for fund) |
| charge_threshold | number | – | Balance threshold to trigger auto charge, min $1 (required for auto-funding) |
| coupon_code | string | – | Coupon code (required for validate-coupon, redeem-coupon) |
| idempotency_key | string | – | Idempotency key for mutation actions (optional — auto-generated if omitted for fund, auto-funding, redeem-coupon) |
| payment_intent_id | string | – | Stripe payment intent ID (required for payment-status) |
| payment_method_id | string | – | Stripe payment method ID (optional for fund — charges immediately if provided, otherwise creates checkout session; required for bonus coupon redeem) |
| purchase_amount | number | – | Purchase amount for bonus coupons (optional for validate-coupon, required for bonus coupon redeem) |
| session_id | string | – | Stripe checkout session ID (required for confirm-checkout) |
No output schema declared.
No examples provided.
How do I install the ModelsLab Agent Control Plane MCP server?
ModelsLab Agent Control Plane is a hosted endpoint at https://modelslab.com/mcp/agents, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · modelslab.com
claude mcp add --transport http modelslab-modelslab-agents 'https://modelslab.com/mcp/agents'
What is the ModelsLab Agent Control Plane MCP server?
ModelsLab Agent Control Plane is an MCP server listed in the public MCP registry as io.github.ModelsLab/modelslab-agents. Account, billing, team, API key and model discovery tools for agents that use ModelsLab. This page covers its hosted endpoint (https://modelslab.com/mcp/agents).
Is the ModelsLab Agent Control Plane MCP server safe to use?
ModelsLab Agent Control Plane scores 76 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the ModelsLab Agent Control Plane MCP server expose?
ModelsLab Agent Control Plane exposes 10 tools: agent-auth, agent-tokens, agent-profile, agent-api-keys, agent-usage, and 5 more. Their descriptions and schemas cost roughly 2,868 tokens of context every time the server is loaded.
Does the ModelsLab Agent Control Plane MCP server require authentication?
No. We connected to ModelsLab Agent Control Plane without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the ModelsLab Agent Control Plane MCP server still maintained?
ModelsLab Agent Control Plane is still listed as active in the MCP registry. We last reached this channel on 24 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.