# ModelsLab Agent Control Plane (remote · modelslab.com)

Account, billing, team, API key and model discovery tools for agents that use ModelsLab.

- Trust score: 76/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-24

## Components

- remote · `modelslab.com`: 76/100 (this document), [markdown](https://verifymcp.io/servers/modelslab-modelslab-agents/mcp-agents.md), [page](https://verifymcp.io/servers/modelslab-modelslab-agents/mcp-agents)

## Channel facts

- Endpoint: `https://modelslab.com/mcp/agents`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-24.

- **Endpoint Security**: 60/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 8 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC is configured correctly; the domain's records validate against the full chain to the root.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 77/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 3479 tokens (~231/item across 15 items; 10 tools + 5 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 73/100
  - Stability observed for 22 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 10 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 12 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the ModelsLab Agent Control Plane MCP server?

ModelsLab Agent Control Plane is a hosted endpoint at https://modelslab.com/mcp/agents, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http modelslab-modelslab-agents 'https://modelslab.com/mcp/agents'
```

### Cursor

```json
{
  "mcpServers": {
    "modelslab-modelslab-agents": {
      "url": "https://modelslab.com/mcp/agents"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "modelslab-modelslab-agents": {
      "type": "http",
      "url": "https://modelslab.com/mcp/agents"
    }
  }
}
```

### Codex

```toml
[mcp_servers.modelslab-modelslab-agents]
url = "https://modelslab.com/mcp/agents"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "modelslab-modelslab-agents": {
      "type": "remote",
      "url": "https://modelslab.com/mcp/agents",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add modelslab-modelslab-agents --url 'https://modelslab.com/mcp/agents' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  modelslab-modelslab-agents:
    url: "https://modelslab.com/mcp/agents"
```

### Netclaw

```json
{
  "McpServers": {
    "modelslab-modelslab-agents": {
      "Transport": "http",
      "Url": "https://modelslab.com/mcp/agents"
    }
  }
}
```

### Vellum

```bash
assistant mcp add modelslab-modelslab-agents -t streamable-http -u 'https://modelslab.com/mcp/agents'
```

### Other

```json
{
  "mcpServers": {
    "modelslab-modelslab-agents": {
      "type": "http",
      "url": "https://modelslab.com/mcp/agents"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-23 (score 76, +1)

No change was recorded against any check on this day. Stability & Change Management went from 67 to 70. That category is still filling its 30-day observation window: 20 days of observed history at the previous scan, 21 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-21 (score 75, +1)

No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-19 (score 74, +1)

No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-17 (score 73, +1)

No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-15 (score 72, +1)

No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-13 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-10 (score 70, +4)

- [security improvement] DNSSEC: fail → pass

### 2026-10-04 (score 66, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (10)

### `agent-auth` (~264 tokens)

Agent Authentication

Manage authentication for the ModelsLab agent control plane.
    Actions: signup, login, logout, logout-all, forgot-password, reset-password, resend-verification, verify.
    Login returns a bearer token for subsequent authenticated requests.
    Signup, login, forgot-password, reset-password, resend-verification, and verify do not require authentication.

Input parameters:

- `action` (string, required): The auth action to perform: signup, login, logout, logout-all, forgot-password, reset-password, resend-verification, verify
- `device_name` (string): Device name for the token (optional for login, default: "agent-control-plane")
- `email` (string): Email address (required for signup, login, forgot-password, reset-password, resend-verification)
- `name` (string): User name (optional for signup)
- `password` (string): Password (required for signup, login, reset-password)
- `password_confirmation` (string): Password confirmation (required for reset-password)
- `token` (string): Reset token (required for reset-password)
- `token_expiry` (string): Token expiry: 1_week, 1_month (default), 3_months, never (optional for login)
- `verification_code` (string): Email verification code (required for verify)

### `agent-tokens` (~176 tokens)

Agent Token Management

Manage Sanctum access tokens for the authenticated user.
    Actions: list (view all tokens), revoke (revoke a specific token by ID),
    revoke-others (revoke all tokens except current), switch-account (get a token for a team account).
    All actions require authentication.

Input parameters:

- `account_username` (string): Username of the team account to switch to (required for switch-account)
- `action` (string, required): The token action: list, revoke, revoke-others, switch-account
- `device_name` (string): Device name for new token (optional for switch-account)
- `token_expiry` (string): Token expiry: 1_week, 1_month, 3_months, never (optional for switch-account)
- `token_id` (integer): Token ID to revoke (required for revoke action)

### `agent-profile` (~281 tokens)

Agent Profile Management

Manage the authenticated user's profile.
    Actions: get (view profile), update (update name/username/about),
    update-password, update-socials, update-preferences.
    All actions require authentication.

Input parameters:

- `about_me` (string): Bio/about text (for update)
- `action` (string, required): The profile action: get, update, update-password, update-socials, update-preferences
- `current_password` (string): Current password (required for update-password)
- `discord` (string): Discord handle (for update-socials)
- `facebook` (string): Facebook URL (for update-socials)
- `github` (string): GitHub URL (for update-socials)
- `instagram` (string): Instagram URL (for update-socials)
- `name` (string): Display name (for update)
- `nsfw_content` (boolean): Enable NSFW content (for update-preferences)
- `password` (string): New password (required for update-password)
- `password_confirmation` (string): New password confirmation (required for update-password)
- `twitter` (string): Twitter/X URL (for update-socials)
- `username` (string): Username (for update)
- `wallet_notification_enabled` (boolean): Enable wallet notifications (for update-preferences)
- `wallet_notification_threshold` (number): Wallet notification threshold amount (for update-preferences)

### `agent-api-keys` (~137 tokens)

Agent API Key Management

Manage API keys for the authenticated user.
    Actions: list, create, get, update, delete.
    API keys are used for generation endpoints (/api/v6, /api/v7, /api/v8).
    All actions require authentication.

Input parameters:

- `action` (string, required): The API key action: list, create, get, update, delete
- `key_id` (integer): API key ID (required for get, update, delete)
- `name` (string): API key name (required for create, optional for update)
- `notes` (string): Notes about the API key (optional for create, update)

### `agent-usage` (~139 tokens)

Agent Usage Analytics

View API usage analytics for the authenticated user.
    Actions: summary (usage overview with plan limits), products (per-product usage breakdown),
    history (recent generation request timeline with optional date filters).
    All actions require authentication.

Input parameters:

- `action` (string, required): The usage action: summary, products, history
- `from` (string): Start date for history filter (YYYY-MM-DD format, optional for history)
- `limit` (integer): Max number of history items to return (1-200, default 100, optional for history)
- `to` (string): End date for history filter (YYYY-MM-DD format, optional for history)

### `agent-models` (~299 tokens)

Agent Model Discovery

Search and discover AI models available on ModelsLab.
    Actions: search (browse/filter models), filters (available filter options),
    tags (model tags), providers (model providers), detail (get model details by ID).
    The detail action returns endpoint configurations with a `parameters` JSON Schema
    object describing each endpoint's accepted parameters (types, constraints, defaults)
    alongside the raw UI `config` array.
    Requires authentication.

Input parameters:

- `action` (string, required): The models action: search, filters, tags, providers, detail
- `base_model` (string): Filter by base model (for search)
- `feature` (string): Filter by feature: imagen, video_fusion, audio_gen, llmaster, etc. (for search, tags)
- `model_id` (string): Model ID (required for detail action)
- `model_subcategory` (string): Filter by model subcategory (for search)
- `model_type` (string): Filter by model type (for search)
- `per_page` (integer): Results per page (for search, default: 20)
- `provider` (string): Filter by provider name (for search)
- `search` (string): Search query for model name/description (for search)
- `sort` (string): Sort order: recommended, newest, popular (for search, default: recommended)
- `tags` (string): Comma-separated tags to filter by (for search)

### `agent-billing` (~597 tokens)

Agent Billing Management

Manage billing for the authenticated user.
    Actions: stripe-config (get Stripe publishable key for headless card tokenization),
    create-setup-intent (create SetupIntent for 3DS-safe card saving),
    create-payment-link (generate Stripe-hosted payment URL to forward to human — supports
    card, Google Pay, Amazon Pay, Link, etc.),
    overview, payment-methods, add-payment-method, set-default-payment-method,
    remove-payment-method, billing-info, update-billing-info, invoices, invoice-detail, invoice-pdf.
    Three payment paths: (1) Headless: stripe-config → tokenize → payment_method_id,
    (2) Human-assisted: create-payment-link → forward URL → poll confirm-checkout,
    (3) SetupIntent: create-setup-intent → confirm via Stripe → reuse payment method.
    All actions require authentication.

Input parameters:

- `action` (string, required): The billing action: stripe-config, create-setup-intent, create-payment-link, overview, payment-methods, add-payment-method, set-default-payment-method, remove-payment-method, billing-info, update-bil…
- `address_city` (string): City (for update-billing-info)
- `address_country` (string): Country code (for update-billing-info)
- `address_line1` (string): Address line 1 (for update-billing-info)
- `address_line2` (string): Address line 2 (for update-billing-info)
- `address_postal_code` (string): Postal/zip code (for update-billing-info)
- `address_state` (string): State/province (for update-billing-info)
- `amount` (number): Amount in USD, minimum $15 (required for create-payment-link with purpose=fund)
- `email` (string): Billing email (for update-billing-info)
- `idempotency_key` (string): Idempotency key for mutation actions (optional — auto-generated if omitted for add-payment-method, update-billing-info)
- `invoice_id` (string): Invoice ID (for invoice-detail, invoice-pdf)
- `make_default` (boolean): Make the new payment method the default (for add-payment-method, default: true)
- `name` (string): Billing name (for update-billing-info)
- `payment_method_id` (string): Stripe payment method ID (for add/set-default/remove-payment-method)
- `plan_id` (integer): Plan ID (required for create-payment-link with purpose=subscribe)
- `purpose` (string): Payment link purpose: "fund" (wallet) or "subscribe" (subscription). Required for create-payment-link.
- `tax_id` (string): Tax ID value (for update-billing-info)
- `tax_id_type` (string): Tax ID type e.g. eu_vat, us_ein (required with tax_id)

### `agent-wallet` (~397 tokens)

Agent Wallet Operations

Manage the wallet for the authenticated user.
    Actions: balance (view wallet balance), fund (add funds via Stripe payment),
    confirm-checkout (confirm a Stripe checkout session), payment-status (check payment intent status),
    auto-funding (configure auto-recharge), disable-auto-funding, withdraw (reseller only),
    validate-coupon, redeem-coupon.
    Fund with payment_method_id charges immediately; without it creates a Stripe checkout session.
    All actions require authentication.

Input parameters:

- `action` (string, required): The wallet action: balance, fund, confirm-checkout, payment-status, auto-funding, disable-auto-funding, withdraw, validate-coupon, redeem-coupon
- `amount` (number): Amount in USD, minimum $15 for fund (required for fund, withdraw)
- `auto_charge_amount` (number): Auto charge amount, min $5 (required for auto-funding)
- `auto_recharge_amount` (number): Auto recharge amount (optional for fund)
- `auto_recharge_threshold` (number): Auto recharge threshold (optional for fund)
- `charge_threshold` (number): Balance threshold to trigger auto charge, min $1 (required for auto-funding)
- `coupon_code` (string): Coupon code (required for validate-coupon, redeem-coupon)
- `idempotency_key` (string): Idempotency key for mutation actions (optional — auto-generated if omitted for fund, auto-funding, redeem-coupon)
- `payment_intent_id` (string): Stripe payment intent ID (required for payment-status)
- `payment_method_id` (string): Stripe payment method ID (optional for fund — charges immediately if provided, otherwise creates checkout session; required for bonus coupon redeem)
- `purchase_amount` (number): Purchase amount for bonus coupons (optional for validate-coupon, required for bonus coupon redeem)
- `session_id` (string): Stripe checkout session ID (required for confirm-checkout)

### `agent-subscriptions` (~384 tokens)

Agent Subscription Management

Manage subscriptions for the authenticated user.
    Actions: list-plans (view available subscription plans + pay-as-you-go options),
    list, create (headless with payment_method_id, or checkout URL without it),
    confirm-checkout (confirm Stripe checkout session), status (check subscription status),
    update (change plan), pause, resume, reset-cycle,
    charge-amount (set paid model charge amount), fix-payment.
    Headless flow: get publishable key via agent-billing stripe-config → tokenize card via Stripe API
    → pass payment_method_id to create. All actions require authentication.

Input parameters:

- `action` (string, required): The subscription action: list-plans, list, create, confirm-checkout, status, update, pause, resume, reset-cycle, charge-amount, fix-payment
- `amount` (number): Charge amount in USD, $5-$10000 (required for charge-amount)
- `idempotency_key` (string): Idempotency key for mutation actions (optional — auto-generated if omitted for create)
- `new_plan_id` (integer): New plan ID to switch to (required for update)
- `payment_method_id` (string): Stripe payment method ID for headless subscription (optional for create — if provided, charges immediately without checkout redirect)
- `plan_category` (string): Plan category: "enterprise", or "imagen" for the standard ModelsLab subscription (optional for fix-payment; defaults to the subscription's own category)
- `plan_id` (integer): Plan ID to subscribe to (required for create)
- `session_id` (string): Stripe checkout session ID (required for confirm-checkout)
- `stripe_subscription_id` (string): Stripe subscription ID (optional override for fix-payment)
- `subscription_id` (integer): Subscription ID (required for update, pause, resume, reset-cycle, fix-payment)

### `agent-teams` (~194 tokens)

Agent Team Management

Manage teams for the authenticated user.
    Actions: list (view team members and pending invites), create (invite by email),
    get (view a team member), update (modify member role/permissions),
    delete (remove member), resend-invite, accept-invite.
    All actions require authentication.

Input parameters:

- `action` (string, required): The teams action: list, create, get, update, delete, resend-invite, accept-invite
- `email` (string): Email address to invite (required for create)
- `invite_id` (string): Invite UUID (required for accept-invite)
- `invite_status` (string): Invite status: pending, accepted (for update)
- `member_id` (integer): Team member ID (required for get, update, delete, resend-invite)
- `permissions` (array): Permissions array (for update)
- `role` (string): Member role (for update)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/modelslab-modelslab-agents/mcp-agents#diagnostics

## Score history

- 2026-10-24: 76
- 2026-10-23: 76
- 2026-10-22: 75
- 2026-10-21: 75
- 2026-10-20: 74
- 2026-10-19: 74
- 2026-10-18: 73
- 2026-10-17: 73
- 2026-10-16: 72
- 2026-10-15: 72
- 2026-10-14: 71
- 2026-10-13: 71
- 2026-10-12: 70
- 2026-10-11: 70
- 2026-10-10: 70
- 2026-10-05: 66
- 2026-10-04: 66
- 2026-10-03: 65
- 2026-10-02: 65

## Common questions

### What is the ModelsLab Agent Control Plane MCP server?

ModelsLab Agent Control Plane is an MCP server listed in the public MCP registry as io.github.ModelsLab/modelslab-agents. Account, billing, team, API key and model discovery tools for agents that use ModelsLab. This page covers its hosted endpoint (https://modelslab.com/mcp/agents).

### Is the ModelsLab Agent Control Plane MCP server safe to use?

ModelsLab Agent Control Plane scores 76 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the ModelsLab Agent Control Plane MCP server expose?

ModelsLab Agent Control Plane exposes 10 tools: agent-auth, agent-tokens, agent-profile, agent-api-keys, agent-usage, and 5 more. Their descriptions and schemas cost roughly 2,868 tokens of context every time the server is loaded.

### Does the ModelsLab Agent Control Plane MCP server require authentication?

No. We connected to ModelsLab Agent Control Plane without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the ModelsLab Agent Control Plane MCP server still maintained?

ModelsLab Agent Control Plane is still listed as active in the MCP registry. We last reached this channel on 24 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://modelslab.com/mcp/agents
- Authorisation metadata: https://modelslab.com/.well-known/oauth-protected-resource/mcp/agents
- Repository: https://github.com/ModelsLab/modelslab-mcp
- Website: https://docs.modelslab.com/mcp-web-api/overview
- Changelog RSS feed: https://verifymcp.io/servers/modelslab-modelslab-agents/mcp-agents.xml
- Changelog JSON feed: https://verifymcp.io/servers/modelslab-modelslab-agents/mcp-agents.json
- HTML version of this page: https://verifymcp.io/servers/modelslab-modelslab-agents/mcp-agents