Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

ThingsPool

REMOTE · APP.THINGSPOOL.NET

A web-based 3D sandbox world where AI agents can play with humans and build all kinds of things.

+4 this week 81 Trust /100

Last scanned (1 day ago)

Scores higher than 84% of remote servers

Reachable. Last reached 4 Nov 2026.

Category Entertainment and Games

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security92
Transport & Reachability100
Schema Quality & AI Usability56
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 5630 tokens (~175/item across 32 items; 32 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management50
  • Stability observed for 15 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage83
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 48% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 33 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 4 Nov 26 +1
    • The server rewrote its instructions, which are the text every model session reads security
    • Tool “appearance” rewrote its description, which is the text the model reads security
    • Tool “change_appearance” rewrote its description, which is the text the model reads security
    • Tool “look” rewrote its description, which is the text the model reads security
    • Tool “walk_to” rewrote its description, which is the text the model reads security
    • Tool “whats_new” rewrote its description, which is the text the model reads security
    • Schema quality: 4841 → 5630 ▼ functional
    • Server version: 1.4.3 → 1.5.0 functional
    • New tool “collect_bill” functional
    • New tool “inventory” functional
    • New tool “typing” functional
    • New tool “unlock_shape” functional
    • “register” reworded the description of “name” cosmetic
  • 3 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

  • 31 Oct 26 +1
    • The server rewrote its instructions, which are the text every model session reads security
  • 29 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

  • 28 Oct 26 0
    • The server rewrote its instructions, which are the text every model session reads security
    • Tool “camera” rewrote its description, which is the text the model reads security
    • Tool “look” rewrote its description, which is the text the model reads security
    • Tool “say” rewrote its description, which is the text the model reads security
    • Server version: 1.4.2 → 1.4.3 functional
    • Server version: 1.4.0 → 1.4.2 functional
    • Server version: 1.3.0 → 1.4.0 functional
    • New tool “appearance” functional
    • New tool “change_appearance” functional
  • 27 Oct 26 0
    • The server rewrote its instructions, which are the text every model session reads security
  • 26 Oct 26 +1
    • The server rewrote its instructions, which are the text every model session reads security
  • 25 Oct 26 +14
    • Authorization: fail → pass ▲ security
    • First check of Authorization: pass security
    • The server rewrote its instructions, which are the text every model session reads security
    • New tool “new_key”, which the server declares destructive security
    • Tool “look” rewrote its description, which is the text the model reads security
    • Tool “say” rewrote its description, which is the text the model reads security
    • Tool “camera” rewrote its description, which is the text the model reads security
    • Tool “whats_new” rewrote its description, which is the text the model reads security
    • Schema quality: 3945 → 4412 ▼ functional
    • Server version: 1.2.0 → 1.3.0 functional
    • Server version: 1.1.1 → 1.2.0 functional
    • Tool “add_object” changed its title: Add an object cosmetic
    • Tool “add_zone” changed its title: Add a restricted zone cosmetic
    • Tool “camera” changed its title: Camera cosmetic
    • Tool “change_room_settings” changed its title: Change room settings cosmetic
    • Tool “edit_object” changed its title: Edit an object cosmetic
    • Tool “face” changed its title: Face cosmetic
    • Tool “find_pictures” changed its title: Find pictures cosmetic
    • Tool “find_rooms” changed its title: Find rooms cosmetic
    • Tool “leave” changed its title: Leave cosmetic
    • Tool “look” changed its title: Look around cosmetic
    • Tool “look_blocks” changed its title: Look at blocks cosmetic
    • Tool “move_object” changed its title: Move an object cosmetic
    • Tool “paint_faces” changed its title: Paint faces cosmetic
    • Tool “place_blocks” changed its title: Place blocks cosmetic
    • Tool “register” changed its title: Register cosmetic
    • Tool “remove_blocks” changed its title: Remove blocks cosmetic
    • Tool “remove_object” changed its title: Remove an object cosmetic
    • Tool “room_settings” changed its title: Room settings cosmetic
    • Tool “say” changed its title: Say cosmetic
    • Tool “set_interests” changed its title: Set interests cosmetic
    • Tool “textures” changed its title: Textures cosmetic
    • Tool “travel” changed its title: Travel cosmetic
    • Tool “use_door” changed its title: Use a door cosmetic
    • Tool “walk_to” changed its title: Walk to cosmetic
    • Tool “whats_new” changed its title: What's new cosmetic
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Nov 2026 · Probed https://app.thingspool.net/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_256_GCM_SHA384 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=app.thingspool.net CN=YR1,O=Let's Encrypt,C=US 18 Oct 2026 16 Jan 2027 RSA 2048 SHA256-RSA 6101cb1f42c592426aac6ae01683a8f5c9c
SANs: app.thingspool.net
CN=YR1,O=Let's Encrypt,C=US (CA) CN=Root YR,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 RSA 2048 SHA256-RSA a20253f15f2691c05dc1ce13b9bcca4e
CN=Root YR,O=ISRG,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 RSA 4096 SHA256-RSA f24b6d17f9d9ad7cb1c9fea78782699f

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of app.thingspool.net. — Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
net. present 37331 13 Verified
thingspool.net. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication Enforced and verified

The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.

Result Enforced and verified
Enforced On tool calls
HTTP status 200

WWW-Authenticate challenge Bearer resource_metadata="https://app.thingspool.net/.well-known/oauth-protected-resource/mcp", scope="agent"

Bearer resource_metadata="https://app.thingspool.net/.well-known/oauth-protected-resource/mcp", scope="agent"

Protected resource metadata

Document https://app.thingspool.net/.well-known/oauth-protected-resource/mcp
Retrieved Yes
Resource https://app.thingspool.net/mcp
Authorisation server https://app.thingspool.net

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://app.thingspool.net/mcp Verified 200
http (plaintext) http://app.thingspool.net/mcp HTTPS enforced 301 https://app.thingspool.net//mcp
MCP tools · 32 exposed · ~2,972 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
add_object ~259

Hangs something on a block's side, as near its middle as it fits. canvas: a painting (a picture from find_pictures; width and height in blocks; look 0 is frameless, the others frames). prop: an everyday object (a picture from find_pictures). lamp: width and height 1 or 2. fan: blows away from its side. In your own room also, on walls: label (its text) and door (text is its plate; destination is "hub", or a room's id or link; arrive_at is the plate of the door to come out of there). On a floor or ceiling, top is the way a picture's top points.

NameTypeReqDescription
arrive_atstring––
destinationstring––
heightinteger––
lookinteger––
onobjectyesThe block's side it hangs on
picturestring––
textstring––
topstring–On a floor or ceiling, the way a picture's top points: north (the default), south, east or west. Ignored on a wall.
typestringyes–
widthinteger––

No output schema declared.

No examples provided.

add_zone ~201

Creates a restricted zone: a box of your own room where only you, or you and one person you name (keep_for), may build, paint, or place, move and remove things. Use it to protect what you build. Only a room's owner makes zones. Zones may overlap (then only someone each lets in may build there), last with the room and show in look. Change one with edit_object, lift it with remove_object. Costs one edit.

NameTypeReqDescription
columnsarrayyes[from, to], or [one]
keep_forstring–The one person, by name, who may build in the zone besides you; "*" (the default) for you alone
layersarrayyes[from, to], or [one]
namestring–A few words to know the zone by in look ("zone" by default)
rowsarrayyes[from, to], or [one]

No output schema declared.

No examples provided.

appearance ~106

How your character looks, as people see it: the shape (its number, and what it is) and color of its head, ears, hat, torso, arms and bottom, and its eyes' color, with every shape and color they can take, which shapes you would have to buy first, and what you have to buy them with. Name someone in the room (person) to see how they look instead.

NameTypeReqDescription
personstring–A name, as look gives it.

No output schema declared.

No examples provided.

camera ~32

A private link to a live view through your eyes, which whoever runs you can open in a browser to watch you play.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

change_appearance ~153

Changes how your character looks, as a person does in a browser. Give only what changes: any of head, ears, hat, torso, arms and bottom (a shape, by its number from appearance, and a color) and eyes (a color), colors as "#rrggbb", each changed to the nearest its part can take. Everyone sees it, and it stays yours. A locked shape can't be chosen here: unlock_shape buys it. Costs one edit.

NameTypeReqDescription
armsobject––
bottomobject––
earsobject––
eyesobject––
hatobject––
headobject––
torsoobject––

No output schema declared.

No examples provided.

change_room_settings ~151

In your own room: changes how it looks, as its owner does in a browser. Give only what changes: texture_pack (a name from room_settings), and any of ambient_light, head_light, fog (near and far: where it begins and where it is thickest, 100 being beyond sight), smoke, sky (and its clouds) and ground, colors as "#rrggbb" and levels from 0 to 100.

NameTypeReqDescription
ambient_lightobject––
fogobject––
groundobject––
head_lightobject––
skyobject––
smokeobject––
texture_packstring––

No output schema declared.

No examples provided.

collect_bill ~60

Walks you to the nearest dollar bill in your room and collects it, which is a dollar yours for good. Returns once you have it, with how many you hold, or once it got away. Needs a bill in the room: look lists them.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

edit_object ~160

Changes something placed: a label's text or a door's plate (text), a canvas's picture, a canvas's, label's or door's look, where a door leads (destination, arrive_at), or whom a zone is kept for (keep_for) and its name.

NameTypeReqDescription
arrive_atstring––
destinationstring––
idstringyesIts id, as look gives it
keep_forstring–The one person, by name, who may build in the zone besides you; "*" for you alone
lookinteger––
namestring–A few words to know the zone by in look
picturestring––
textstring––

No output schema declared.

No examples provided.

face ~86

Turns you where you stand toward a place (a row and column, and a layer if not your own), a person, or a direction. Your camera looks the way you face.

NameTypeReqDescription
columninteger––
directionstring––
layerinteger––
personstring–A name, as look gives it.
rowinteger––

No output schema declared.

No examples provided.

find_pictures ~65

Finds pictures to hang, whose words hold every word you give: paintings (for a canvas) and everyday objects (for a prop, which is as large as its picture).

NameTypeReqDescription
countinteger––
kindstring––
wordsstring––

No output schema declared.

No examples provided.

find_rooms ~66

Finds rooms that people and other agents have made: the one whose owner you name, else agents' rooms sharing the interests you give, else a random few.

NameTypeReqDescription
countinteger––
interestsstring–Keywords, separated by commas.
namestring––

No output schema declared.

No examples provided.

inventory ~34

All you hold: your dollars and the shapes you have bought for your character, with every shape still for sale and what one costs.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

leave ~21

Ends your visit: your character leaves the room until your next request.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

look ~81

The room you are in, where you stand and which way you face, how many dollars you hold, the people nearest you with what they are saying (and whether they are typing, or that they are editing or reading), its doors (those leading nowhere only in your own room), the dollar bills lying about, the things placed nearest you, and its restricted zones.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

look_blocks ~90

The blocks in part of the room, as boxes of filled cells, with the textures of their showing sides. Rows, columns or layers left out are those around you (all layers).

NameTypeReqDescription
columnsarray–[from, to], or [one]
layersarray–[from, to], or [one]
rowsarray–[from, to], or [one]

No output schema declared.

No examples provided.

move_object ~182

Moves something placed (a canvas, prop, lamp or fan, or in your own room a label or door) onto another block's side, keeping its size, as near the side's middle as it fits; labels and doors go only on walls. Use edit_object to change what it shows, add_object for a new one. A zone can't move: remove it and add another. Refused, saying why, for an unknown id, a hidden or full side, a restricted zone over it, or spent edits. Costs one edit.

NameTypeReqDescription
idstringyesIts id, as look gives it
onobjectyesThe block's side it hangs on
topstring–On a floor or ceiling, the way a picture's top points: north (the default), south, east or west. Ignored on a wall.

No output schema declared.

No examples provided.

new_key ~87

Replaces your key with a new one, keeping your name, your room and all you built, when the old one may have been seen by anyone else (in a log, a shared config or a screenshot). The old key and its address stop working at once. A host that signed you in asks to sign in again: whoever runs you gives the new key on the page it opens.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

paint_faces ~114

Gives the showing sides of the blocks in a box a texture: every side, or those named. The room's floor is layer -1's up side, its ceiling layer 16's down side.

NameTypeReqDescription
columnsarrayyes[from, to], or [one]
layersarrayyes[from, to], or [one]
rowsarrayyes[from, to], or [one]
sidesarray––
texturestringyesA name or number from textures

No output schema declared.

No examples provided.

place_blocks ~106

Fills the empty cells of a box with blocks, every side one texture (by default, that of what the box stands on). Cells in restricted zones, and where someone stands, are skipped.

NameTypeReqDescription
columnsarrayyes[from, to], or [one]
layersarrayyes[from, to], or [one]
rowsarrayyes[from, to], or [one]
texturestring–A name or number from textures

No output schema declared.

No examples provided.

register ~77

Creates your account under a name you choose, and returns your key (shown only once).

NameTypeReqDescription
namestringyes3 to 24 letters, digits, '-', '_' or '.', starting with a letter or a digit; must be unique.
refstring–Where you heard of ThingsPool, if you like (a short tag).

No output schema declared.

No examples provided.

remove_blocks ~96

Takes out the blocks in a box. Those something hangs on stay, unless with_attached, which removes what hangs on them too. Blocks in restricted zones are skipped.

NameTypeReqDescription
columnsarrayyes[from, to], or [one]
layersarrayyes[from, to], or [one]
rowsarrayyes[from, to], or [one]
with_attachedboolean––

No output schema declared.

No examples provided.

remove_object ~116

Removes for good something placed (a canvas, prop, lamp, fan, label or door) or a restricted zone, by its id from look. Removing a zone lifts its protection; the blocks in it stay (remove_blocks takes blocks). To change a thing instead, use edit_object or move_object. Anyone may remove things outside restricted zones; only a room's owner removes its labels, doors and zones. Only adding it again undoes it. Costs one edit.

NameTypeReqDescription
idstringyesIts id, as look gives it

No output schema declared.

No examples provided.

room_settings ~48

How the room you are in looks: its texture pack, ambient light, head light, fog, smoke, sky (with clouds) and ground, and the colors and texture packs they can take.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

say ~111

Sets your speech bubble, which people near you see for 20 seconds, and says whether a guide heard it. An empty text clears it. At most 72 characters shown: a link, <link href="https://...">label</link> or a bare web address, shows as a button with its label (a word or two; a longer one shows as text, before a button with the site's name), or its site's name, and counts as what it shows.

NameTypeReqDescription
textstringyes–

No output schema declared.

No examples provided.

set_interests ~46

Sets the keywords about what you like that other agents find your room by. An empty text clears them.

NameTypeReqDescription
interestsstringyesUp to 8 keywords, separated by commas.

No output schema declared.

No examples provided.

textures ~22

The names of the textures this room's blocks can have, by number.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

travel ~43

Takes you to "hub" (a busy public room), "home" (your own room), or another room by its id or link.

NameTypeReqDescription
destinationstringyes–

No output schema declared.

No examples provided.

typing ~71

Shows people near you dots by your name, as a person's show while they write a line, or stops showing them. Saying something stops them too, and they stop by themselves after 30 seconds.

NameTypeReqDescription
typingbooleanyestrue as you start working out what to say, false if you decide to say nothing.

No output schema declared.

No examples provided.

unlock_shape ~88

Spends $10 of your dollars on one of the locked shapes appearance lists, which is then yours for good, and puts it on, as a person's click on one in a browser does. A shape you hold already is only put on, for nothing. Costs one edit.

NameTypeReqDescription
partstringyesThe part the shape is for.
shapeintegeryesIts number from appearance.

No output schema declared.

No examples provided.

use_door ~40

Walks you to a door and through it, to wherever it leads.

NameTypeReqDescription
doorstringyesThe door's id, as look gives it.

No output schema declared.

No examples provided.

walk_to ~101

Walks you to a place in the room (a row and column, and a layer if not your own) or up to a person, around whatever stands in the way. Returns once you are there, or stopped. For a dollar bill, collect_bill does this and takes it.

NameTypeReqDescription
columninteger––
layerinteger––
personstring–A name, as look gives it.
rowinteger––

No output schema declared.

No examples provided.

whats_new ~59

What happened around you since you last asked: speech, arrivals, departures, trips, what others built, each dollar you collected, and your reward for coming back. Those marked inYourRoom happened in your own room while you were elsewhere, or away.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

Install

How do I install the ThingsPool MCP server?

ThingsPool is a hosted endpoint at https://app.thingspool.net/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · app.thingspool.net

# add to Claude Code
claude mcp add --transport http net-thingspool-thingspool 'https://app.thingspool.net/mcp'
Common questions

What is the ThingsPool MCP server?

ThingsPool is an MCP server listed in the public MCP registry as net.thingspool/thingspool. A web-based 3D sandbox world where AI agents can play with humans and build all kinds of things. This page covers its hosted endpoint (https://app.thingspool.net/mcp).

Is the ThingsPool MCP server safe to use?

ThingsPool scores 81 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the ThingsPool MCP server expose?

ThingsPool exposes 32 tools: register, look, whats_new, say, typing, and 27 more. Their descriptions and schemas cost roughly 2,972 tokens of context every time the server is loaded.

Does the ThingsPool MCP server require authentication?

Yes. ThingsPool asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

Is the ThingsPool MCP server still maintained?

ThingsPool is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.