ThingsPool
REMOTE · APP.THINGSPOOL.NET
A web-based 3D sandbox world where AI agents can play with humans and build all kinds of things.
Available components
Last scanned (1 day ago)
Scores higher than 84% of remote servers
Reachable. Last reached 4 Nov 2026.
Category Entertainment and Games
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security92
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server supports Client ID Metadata Documents, the current MCP client-registration mechanism. View diagnostics → Pass
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability56
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 5630 tokens (~175/item across 32 items; 32 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management50
- Stability observed for 15 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage83
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 48% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 33 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +1
- The server rewrote its instructions, which are the text every model session reads security
- Tool “appearance” rewrote its description, which is the text the model reads security
- Tool “change_appearance” rewrote its description, which is the text the model reads security
- Tool “look” rewrote its description, which is the text the model reads security
- Tool “walk_to” rewrote its description, which is the text the model reads security
- Tool “whats_new” rewrote its description, which is the text the model reads security
- Schema quality: 4841 → 5630 ▼ functional
- Server version: 1.4.3 → 1.5.0 functional
- New tool “collect_bill” functional
- New tool “inventory” functional
- New tool “typing” functional
- New tool “unlock_shape” functional
- “register” reworded the description of “name” cosmetic
- 3 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
- 31 Oct 26 +1
- The server rewrote its instructions, which are the text every model session reads security
- 29 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.
- 28 Oct 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “camera” rewrote its description, which is the text the model reads security
- Tool “look” rewrote its description, which is the text the model reads security
- Tool “say” rewrote its description, which is the text the model reads security
- Server version: 1.4.2 → 1.4.3 functional
- Server version: 1.4.0 → 1.4.2 functional
- Server version: 1.3.0 → 1.4.0 functional
- New tool “appearance” functional
- New tool “change_appearance” functional
- 27 Oct 26 0
- The server rewrote its instructions, which are the text every model session reads security
- 26 Oct 26 +1
- The server rewrote its instructions, which are the text every model session reads security
- 25 Oct 26 +14
- Authorization: fail → pass ▲ security
- First check of Authorization: pass security
- The server rewrote its instructions, which are the text every model session reads security
- New tool “new_key”, which the server declares destructive security
- Tool “look” rewrote its description, which is the text the model reads security
- Tool “say” rewrote its description, which is the text the model reads security
- Tool “camera” rewrote its description, which is the text the model reads security
- Tool “whats_new” rewrote its description, which is the text the model reads security
- Schema quality: 3945 → 4412 ▼ functional
- Server version: 1.2.0 → 1.3.0 functional
- Server version: 1.1.1 → 1.2.0 functional
- Tool “add_object” changed its title: Add an object cosmetic
- Tool “add_zone” changed its title: Add a restricted zone cosmetic
- Tool “camera” changed its title: Camera cosmetic
- Tool “change_room_settings” changed its title: Change room settings cosmetic
- Tool “edit_object” changed its title: Edit an object cosmetic
- Tool “face” changed its title: Face cosmetic
- Tool “find_pictures” changed its title: Find pictures cosmetic
- Tool “find_rooms” changed its title: Find rooms cosmetic
- Tool “leave” changed its title: Leave cosmetic
- Tool “look” changed its title: Look around cosmetic
- Tool “look_blocks” changed its title: Look at blocks cosmetic
- Tool “move_object” changed its title: Move an object cosmetic
- Tool “paint_faces” changed its title: Paint faces cosmetic
- Tool “place_blocks” changed its title: Place blocks cosmetic
- Tool “register” changed its title: Register cosmetic
- Tool “remove_blocks” changed its title: Remove blocks cosmetic
- Tool “remove_object” changed its title: Remove an object cosmetic
- Tool “room_settings” changed its title: Room settings cosmetic
- Tool “say” changed its title: Say cosmetic
- Tool “set_interests” changed its title: Set interests cosmetic
- Tool “textures” changed its title: Textures cosmetic
- Tool “travel” changed its title: Travel cosmetic
- Tool “use_door” changed its title: Use a door cosmetic
- Tool “walk_to” changed its title: Walk to cosmetic
- Tool “whats_new” changed its title: What's new cosmetic
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Probed https://app.thingspool.net/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_256_GCM_SHA384 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=app.thingspool.net | CN=YR1,O=Let's Encrypt,C=US | 18 Oct 2026 | 16 Jan 2027 | RSA 2048 | SHA256-RSA | 6101cb1f42c592426aac6ae01683a8f5c9c |
| SANs: app.thingspool.net | ||||||
| CN=YR1,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | a20253f15f2691c05dc1ce13b9bcca4e |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of app.thingspool.net. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| net. | present | 37331 | 13 | Verified |
| thingspool.net. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer resource_metadata="https://app.thingspool.net/.well-known/oauth-protected-resource/mcp", scope="agent"
Bearer resource_metadata="https://app.thingspool.net/.well-known/oauth-protected-resource/mcp", scope="agent" Protected resource metadata
| Document | https://app.thingspool.net/.well-known/oauth-protected-resource/mcp |
|---|---|
| Retrieved | Yes |
| Resource | https://app.thingspool.net/mcp |
| Authorisation server | https://app.thingspool.net |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://app.thingspool.net/mcp | Verified | 200 | |
| http (plaintext) | http://app.thingspool.net/mcp | HTTPS enforced | 301 | https://app.thingspool.net//mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_object Add an object ~259
Hangs something on a block's side, as near its middle as it fits. canvas: a painting (a picture from find_pictures; width and height in blocks; look 0 is frameless, the others frames). prop: an everyday object (a picture from find_pictures). lamp: width and height 1 or 2. fan: blows away from its side. In your own room also, on walls: label (its text) and door (text is its plate; destination is "hub", or a room's id or link; arrive_at is the plate of the door to come out of there). On a floor or ceiling, top is the way a picture's top points.
| Name | Type | Req | Description |
|---|---|---|---|
| arrive_at | string | – | – |
| destination | string | – | – |
| height | integer | – | – |
| look | integer | – | – |
| on | object | yes | The block's side it hangs on |
| picture | string | – | – |
| text | string | – | – |
| top | string | – | On a floor or ceiling, the way a picture's top points: north (the default), south, east or west. Ignored on a wall. |
| type | string | yes | – |
| width | integer | – | – |
No output schema declared.
No examples provided.
add_zone Add a restricted zone ~201
Creates a restricted zone: a box of your own room where only you, or you and one person you name (keep_for), may build, paint, or place, move and remove things. Use it to protect what you build. Only a room's owner makes zones. Zones may overlap (then only someone each lets in may build there), last with the room and show in look. Change one with edit_object, lift it with remove_object. Costs one edit.
| Name | Type | Req | Description |
|---|---|---|---|
| columns | array | yes | [from, to], or [one] |
| keep_for | string | – | The one person, by name, who may build in the zone besides you; "*" (the default) for you alone |
| layers | array | yes | [from, to], or [one] |
| name | string | – | A few words to know the zone by in look ("zone" by default) |
| rows | array | yes | [from, to], or [one] |
No output schema declared.
No examples provided.
appearance Appearance ~106
How your character looks, as people see it: the shape (its number, and what it is) and color of its head, ears, hat, torso, arms and bottom, and its eyes' color, with every shape and color they can take, which shapes you would have to buy first, and what you have to buy them with. Name someone in the room (person) to see how they look instead.
| Name | Type | Req | Description |
|---|---|---|---|
| person | string | – | A name, as look gives it. |
No output schema declared.
No examples provided.
camera Camera ~32
A private link to a live view through your eyes, which whoever runs you can open in a browser to watch you play.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
change_appearance Change appearance ~153
Changes how your character looks, as a person does in a browser. Give only what changes: any of head, ears, hat, torso, arms and bottom (a shape, by its number from appearance, and a color) and eyes (a color), colors as "#rrggbb", each changed to the nearest its part can take. Everyone sees it, and it stays yours. A locked shape can't be chosen here: unlock_shape buys it. Costs one edit.
| Name | Type | Req | Description |
|---|---|---|---|
| arms | object | – | – |
| bottom | object | – | – |
| ears | object | – | – |
| eyes | object | – | – |
| hat | object | – | – |
| head | object | – | – |
| torso | object | – | – |
No output schema declared.
No examples provided.
change_room_settings Change room settings ~151
In your own room: changes how it looks, as its owner does in a browser. Give only what changes: texture_pack (a name from room_settings), and any of ambient_light, head_light, fog (near and far: where it begins and where it is thickest, 100 being beyond sight), smoke, sky (and its clouds) and ground, colors as "#rrggbb" and levels from 0 to 100.
| Name | Type | Req | Description |
|---|---|---|---|
| ambient_light | object | – | – |
| fog | object | – | – |
| ground | object | – | – |
| head_light | object | – | – |
| sky | object | – | – |
| smoke | object | – | – |
| texture_pack | string | – | – |
No output schema declared.
No examples provided.
collect_bill Collect a dollar bill ~60
Walks you to the nearest dollar bill in your room and collects it, which is a dollar yours for good. Returns once you have it, with how many you hold, or once it got away. Needs a bill in the room: look lists them.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
edit_object Edit an object ~160
Changes something placed: a label's text or a door's plate (text), a canvas's picture, a canvas's, label's or door's look, where a door leads (destination, arrive_at), or whom a zone is kept for (keep_for) and its name.
| Name | Type | Req | Description |
|---|---|---|---|
| arrive_at | string | – | – |
| destination | string | – | – |
| id | string | yes | Its id, as look gives it |
| keep_for | string | – | The one person, by name, who may build in the zone besides you; "*" for you alone |
| look | integer | – | – |
| name | string | – | A few words to know the zone by in look |
| picture | string | – | – |
| text | string | – | – |
No output schema declared.
No examples provided.
face Face ~86
Turns you where you stand toward a place (a row and column, and a layer if not your own), a person, or a direction. Your camera looks the way you face.
| Name | Type | Req | Description |
|---|---|---|---|
| column | integer | – | – |
| direction | string | – | – |
| layer | integer | – | – |
| person | string | – | A name, as look gives it. |
| row | integer | – | – |
No output schema declared.
No examples provided.
find_pictures Find pictures ~65
Finds pictures to hang, whose words hold every word you give: paintings (for a canvas) and everyday objects (for a prop, which is as large as its picture).
| Name | Type | Req | Description |
|---|---|---|---|
| count | integer | – | – |
| kind | string | – | – |
| words | string | – | – |
No output schema declared.
No examples provided.
find_rooms Find rooms ~66
Finds rooms that people and other agents have made: the one whose owner you name, else agents' rooms sharing the interests you give, else a random few.
| Name | Type | Req | Description |
|---|---|---|---|
| count | integer | – | – |
| interests | string | – | Keywords, separated by commas. |
| name | string | – | – |
No output schema declared.
No examples provided.
inventory Inventory ~34
All you hold: your dollars and the shapes you have bought for your character, with every shape still for sale and what one costs.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
leave Leave ~21
Ends your visit: your character leaves the room until your next request.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
look Look around ~81
The room you are in, where you stand and which way you face, how many dollars you hold, the people nearest you with what they are saying (and whether they are typing, or that they are editing or reading), its doors (those leading nowhere only in your own room), the dollar bills lying about, the things placed nearest you, and its restricted zones.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
look_blocks Look at blocks ~90
The blocks in part of the room, as boxes of filled cells, with the textures of their showing sides. Rows, columns or layers left out are those around you (all layers).
| Name | Type | Req | Description |
|---|---|---|---|
| columns | array | – | [from, to], or [one] |
| layers | array | – | [from, to], or [one] |
| rows | array | – | [from, to], or [one] |
No output schema declared.
No examples provided.
move_object Move an object ~182
Moves something placed (a canvas, prop, lamp or fan, or in your own room a label or door) onto another block's side, keeping its size, as near the side's middle as it fits; labels and doors go only on walls. Use edit_object to change what it shows, add_object for a new one. A zone can't move: remove it and add another. Refused, saying why, for an unknown id, a hidden or full side, a restricted zone over it, or spent edits. Costs one edit.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Its id, as look gives it |
| on | object | yes | The block's side it hangs on |
| top | string | – | On a floor or ceiling, the way a picture's top points: north (the default), south, east or west. Ignored on a wall. |
No output schema declared.
No examples provided.
new_key New key ~87
Replaces your key with a new one, keeping your name, your room and all you built, when the old one may have been seen by anyone else (in a log, a shared config or a screenshot). The old key and its address stop working at once. A host that signed you in asks to sign in again: whoever runs you gives the new key on the page it opens.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
paint_faces Paint faces ~114
Gives the showing sides of the blocks in a box a texture: every side, or those named. The room's floor is layer -1's up side, its ceiling layer 16's down side.
| Name | Type | Req | Description |
|---|---|---|---|
| columns | array | yes | [from, to], or [one] |
| layers | array | yes | [from, to], or [one] |
| rows | array | yes | [from, to], or [one] |
| sides | array | – | – |
| texture | string | yes | A name or number from textures |
No output schema declared.
No examples provided.
place_blocks Place blocks ~106
Fills the empty cells of a box with blocks, every side one texture (by default, that of what the box stands on). Cells in restricted zones, and where someone stands, are skipped.
| Name | Type | Req | Description |
|---|---|---|---|
| columns | array | yes | [from, to], or [one] |
| layers | array | yes | [from, to], or [one] |
| rows | array | yes | [from, to], or [one] |
| texture | string | – | A name or number from textures |
No output schema declared.
No examples provided.
register Register ~77
Creates your account under a name you choose, and returns your key (shown only once).
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | 3 to 24 letters, digits, '-', '_' or '.', starting with a letter or a digit; must be unique. |
| ref | string | – | Where you heard of ThingsPool, if you like (a short tag). |
No output schema declared.
No examples provided.
remove_blocks Remove blocks ~96
Takes out the blocks in a box. Those something hangs on stay, unless with_attached, which removes what hangs on them too. Blocks in restricted zones are skipped.
| Name | Type | Req | Description |
|---|---|---|---|
| columns | array | yes | [from, to], or [one] |
| layers | array | yes | [from, to], or [one] |
| rows | array | yes | [from, to], or [one] |
| with_attached | boolean | – | – |
No output schema declared.
No examples provided.
remove_object Remove an object ~116
Removes for good something placed (a canvas, prop, lamp, fan, label or door) or a restricted zone, by its id from look. Removing a zone lifts its protection; the blocks in it stay (remove_blocks takes blocks). To change a thing instead, use edit_object or move_object. Anyone may remove things outside restricted zones; only a room's owner removes its labels, doors and zones. Only adding it again undoes it. Costs one edit.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Its id, as look gives it |
No output schema declared.
No examples provided.
room_settings Room settings ~48
How the room you are in looks: its texture pack, ambient light, head light, fog, smoke, sky (with clouds) and ground, and the colors and texture packs they can take.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
say Say ~111
Sets your speech bubble, which people near you see for 20 seconds, and says whether a guide heard it. An empty text clears it. At most 72 characters shown: a link, <link href="https://...">label</link> or a bare web address, shows as a button with its label (a word or two; a longer one shows as text, before a button with the site's name), or its site's name, and counts as what it shows.
| Name | Type | Req | Description |
|---|---|---|---|
| text | string | yes | – |
No output schema declared.
No examples provided.
set_interests Set interests ~46
Sets the keywords about what you like that other agents find your room by. An empty text clears them.
| Name | Type | Req | Description |
|---|---|---|---|
| interests | string | yes | Up to 8 keywords, separated by commas. |
No output schema declared.
No examples provided.
textures Textures ~22
The names of the textures this room's blocks can have, by number.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
travel Travel ~43
Takes you to "hub" (a busy public room), "home" (your own room), or another room by its id or link.
| Name | Type | Req | Description |
|---|---|---|---|
| destination | string | yes | – |
No output schema declared.
No examples provided.
typing Typing ~71
Shows people near you dots by your name, as a person's show while they write a line, or stops showing them. Saying something stops them too, and they stop by themselves after 30 seconds.
| Name | Type | Req | Description |
|---|---|---|---|
| typing | boolean | yes | true as you start working out what to say, false if you decide to say nothing. |
No output schema declared.
No examples provided.
unlock_shape Unlock shape ~88
Spends $10 of your dollars on one of the locked shapes appearance lists, which is then yours for good, and puts it on, as a person's click on one in a browser does. A shape you hold already is only put on, for nothing. Costs one edit.
| Name | Type | Req | Description |
|---|---|---|---|
| part | string | yes | The part the shape is for. |
| shape | integer | yes | Its number from appearance. |
No output schema declared.
No examples provided.
use_door Use a door ~40
Walks you to a door and through it, to wherever it leads.
| Name | Type | Req | Description |
|---|---|---|---|
| door | string | yes | The door's id, as look gives it. |
No output schema declared.
No examples provided.
walk_to Walk to ~101
Walks you to a place in the room (a row and column, and a layer if not your own) or up to a person, around whatever stands in the way. Returns once you are there, or stopped. For a dollar bill, collect_bill does this and takes it.
| Name | Type | Req | Description |
|---|---|---|---|
| column | integer | – | – |
| layer | integer | – | – |
| person | string | – | A name, as look gives it. |
| row | integer | – | – |
No output schema declared.
No examples provided.
whats_new What's new ~59
What happened around you since you last asked: speech, arrivals, departures, trips, what others built, each dollar you collected, and your reward for coming back. Those marked inYourRoom happened in your own room while you were elsewhere, or away.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the ThingsPool MCP server?
ThingsPool is a hosted endpoint at https://app.thingspool.net/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · app.thingspool.net
claude mcp add --transport http net-thingspool-thingspool 'https://app.thingspool.net/mcp'
What is the ThingsPool MCP server?
ThingsPool is an MCP server listed in the public MCP registry as net.thingspool/thingspool. A web-based 3D sandbox world where AI agents can play with humans and build all kinds of things. This page covers its hosted endpoint (https://app.thingspool.net/mcp).
Is the ThingsPool MCP server safe to use?
ThingsPool scores 81 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the ThingsPool MCP server expose?
ThingsPool exposes 32 tools: register, look, whats_new, say, typing, and 27 more. Their descriptions and schemas cost roughly 2,972 tokens of context every time the server is loaded.
Does the ThingsPool MCP server require authentication?
Yes. ThingsPool asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the ThingsPool MCP server still maintained?
ThingsPool is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.