Nevent MCP
REMOTE · MCP.NEVENT.AI · 2 COMPONENTS · SCANNED SEP 20
Talk to your live-events CRM (campaigns, analytics, paid ads, segments) in Claude and ChatGPT.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (nevent_update_segment). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability69
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 12704 tokens (~215/item across 59 items; 59 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management90
- Stability observed for 27 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety92
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 2 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "nevent_segment_execute" implies "execute" and declares readOnlyHint instead, contradicting what its own name says it does. See how to fix → Partial
- An AI judge read all 60 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Nevent MCP server?
Nevent MCP is a hosted endpoint at https://mcp.nevent.ai/, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · mcp.nevent.ai
claude mcp add --transport http nevent-dev-mcp-nevent 'https://mcp.nevent.ai/'
{
"mcpServers": {
"nevent-dev-mcp-nevent": {
"url": "https://mcp.nevent.ai/"
}
}
} {
"servers": {
"nevent-dev-mcp-nevent": {
"type": "http",
"url": "https://mcp.nevent.ai/"
}
}
} [mcp_servers.nevent-dev-mcp-nevent] url = "https://mcp.nevent.ai/"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"nevent-dev-mcp-nevent": {
"type": "remote",
"url": "https://mcp.nevent.ai/",
"enabled": true
}
}
} openclaw mcp add nevent-dev-mcp-nevent --url 'https://mcp.nevent.ai/' --transport streamable-http
mcp_servers:
nevent-dev-mcp-nevent:
url: "https://mcp.nevent.ai/" {
"McpServers": {
"nevent-dev-mcp-nevent": {
"Transport": "http",
"Url": "https://mcp.nevent.ai/"
}
}
} assistant mcp add nevent-dev-mcp-nevent -t streamable-http -u 'https://mcp.nevent.ai/'
{
"mcpServers": {
"nevent-dev-mcp-nevent": {
"type": "http",
"url": "https://mcp.nevent.ai/"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 73 to 77. That category is still filling its 30-day observation window: 22 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 57 to 60. That category is still filling its 30-day observation window: 17 days of observed history at the previous scan, 18 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “nevent_segment_execute” rewrote its description, which is the text the model reads security
- Tool “nevent_segment_preview” rewrote its description, which is the text the model reads security
- Tool “nevent_create_segment” rewrote its description, which is the text the model reads security
- “nevent_create_segment” reworded the description of “definition” cosmetic
- “nevent_segment_execute” reworded the description of “definition” cosmetic
- “nevent_segment_preview” reworded the description of “definition” cosmetic
- “nevent_update_segment” reworded the description of “definition” cosmetic
- 9 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.
- 7 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Probed https://mcp.nevent.ai/
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=*.nevent.ai | CN=Amazon RSA 2048 M04,O=Amazon,C=US | 21 Aug 2026 | 6 Mar 2027 | RSA 2048 | SHA256-RSA | e35681722decc1b7209ba6e4ecddf69 |
| SANs: *.nevent.ai, nevent.ai | ||||||
| CN=Amazon RSA 2048 M04,O=Amazon,C=US (CA) | CN=Amazon Root CA 1,O=Amazon,C=US | 23 Aug 2022 | 23 Aug 2030 | RSA 2048 | SHA256-RSA | 773124f2a952e3ed18a58bdb85d1bc0ce5f27 |
| CN=Amazon Root CA 1,O=Amazon,C=US (CA) | CN=Starfield Services Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US | 25 May 2015 | 31 Dec 2037 | RSA 2048 | SHA256-RSA | 67f944a2a27cdf3fac2ae2b01f908eeb9c4c6 |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of mcp.nevent.ai. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| ai. | present | 3799 | 8 | Verified |
| nevent.ai. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains |
| content-security-policy | default-src 'self';script-src 'self';style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;font-src 'self' https://fonts.gstatic.com;img-src 'self' data: https://admin.nevent.es https://avatars.slack-edge.com https://upload.wikimedia.org;connect-src 'self';frame-ancestors 'none';form-action *;base-uri 'self';object-src 'none';script-src-attr 'none';upgrade-insecure-requests |
| x-content-type-options | nosniff |
| x-frame-options | SAMEORIGIN |
| referrer-policy | no-referrer |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.nevent.ai/ | Verified | 200 | |
| http (plaintext) | http://mcp.nevent.ai/ | HTTPS enforced |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
nevent_segment_execute ~188
Execute a segment definition and retrieve matching contacts with pagination. SEMANTICS: criteria in the same stanza are OR-combined — a fan matches the stanza if ANY criterion matches. Stanzas are AND-combined — a fan must match EVERY stanza. To require A AND B, put them in separate stanzas; to accept A OR B, put both in the same stanza.
| Name | Type | Req | Description |
|---|---|---|---|
| definition | object | yes | Segment DSL. Criteria in the same stanza are OR-combined: a fan matches the stanza if ANY criterion matches. Stanzas are AND-combined: a fan must match EVERY stanza. To require A AND B, put them in s… |
| page | number | – | Zero-based page index (default 0) |
| page_size | number | – | Results per page (max 100, default 20) |
No output schema declared.
No examples provided.
nevent_segment_preview ~361
Preview estimated audience size for a segment definition without saving it. Returns fan count and sample contacts. SEMANTICS: criteria in the same stanza are OR-combined — a fan matches the stanza if ANY criterion matches. Stanzas are AND-combined — a fan must match EVERY stanza. To require A AND B, put them in separate stanzas; to accept A OR B, put both in the same stanza. MANDATORY RULES: (1) ENTITY operators (is/is_not) accept a single string OR an array of strings (e.g. value: "EVENT_ID" or value: ["EVENT_1","EVENT_2"]). (2) Do NOT include modifiers unless specifically asked for frequency or recency filtering. If included, time_range.value MUST be > 0. KNOWN LIMITATION: Do NOT combine attendance criteria (attended_event, ticket_type) with spending criteria (total_spent, ticket_spent, cashless_recharge_amount) in the SAME stanza. Put them in SEPARATE stanzas. Example — attended EVENT_ID AND spent >= 200, because a fan must match EVERY stanza: { stanzas: [{ criteria: [{ criterion_id: "attended_event", operator: "is", value: "EVENT_ID" }] }, { criteria: [{ criterion_id: "total_spent", operator: "gte", value: 200 }] }] }.
| Name | Type | Req | Description |
|---|---|---|---|
| definition | object | yes | Segment DSL. Criteria in the same stanza are OR-combined: a fan matches the stanza if ANY criterion matches. Stanzas are AND-combined: a fan must match EVERY stanza. To require A AND B, put them in s… |
No output schema declared.
No examples provided.
nevent_segmentation_criteria ~28
List all available audience segmentation criteria including their IDs, operators, and value types.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
nevent_send_test_template ~317
Send a test email of the template to one or more email addresses via SES. Use after nevent_preview_template validates rendering. Test emails carry test indicators in headers and are sent via AWS SES. This call may take up to 60 seconds due to SES delivery. Returns success status, list of recipients the email was sent to, and any error details.
| Name | Type | Req | Description |
|---|---|---|---|
| emails | array | yes | List of email addresses to send the test email to. Each entry must be a valid email address. Minimum 1, maximum 10 recipients. Example: ["qa@example.com", "dev@company.com"]. |
| parameters | object | – | Optional custom parameters for merge-tag substitution in the test email. Key-value pairs where keys match merge tag names. Example: {name: "Juan", city: "Madrid"}. When provided, overrides sample use… |
| sample_user_email | string | – | Optional user email within the active tenant for merge-tag personalization. Ignored when sample_user_id is also provided. |
| sample_user_id | string | – | Optional user ID for merge-tag personalization in the test email. When provided, {{name}}, {{email}} and custom fields are resolved from this user's profile. Takes priority over sample_user_email. |
| subject | string | – | Optional subject line for the test email. Omit to use the default subject from the template. |
| template_id | string | yes | The ID of the email template to send as a test. Use nevent_list_templates to discover valid template IDs. |
No output schema declared.
No examples provided.
nevent_switch_tenant ~216
Switch the active tenant for this session. All subsequent queries (analytics, segments, campaigns, paid media) will use the specified tenant's data. SUPERADMIN: this mutates your user record in the database — the switch PERSISTS. Always call nevent_reset_tenant when cross-tenant work is done to avoid leaving your account pointing at another tenant. OWNER/ADMIN/STAFF: session-scoped only; you can only switch to tenants in your hierarchy subtree (max 3 levels deep). Use nevent_list_tenants to discover available tenant IDs.
| Name | Type | Req | Description |
|---|---|---|---|
| tenant_id | string | yes | The tenant ID to activate for this MCP session. All subsequent analytics, segmentation, campaign, and paid media queries will use this tenant's data. Use nevent_list_tenants to discover available ten… |
No output schema declared.
No examples provided.
nevent_update_segment ~173
Modify an existing segment's name and/or filter definition. Call this after nevent_get_segment to inspect the current definition before changing it. At least one of name or definition must be provided. After update, call nevent_segment_preview to confirm the new audience count before scheduling a campaign.
| Name | Type | Req | Description |
|---|---|---|---|
| definition | object | – | Replacement segment DSL. The full definition is replaced when provided. Criteria in the same stanza are OR-combined: a fan matches the stanza if ANY criterion matches. Stanzas are AND-combined: a fan… |
| name | string | – | New human-readable name for the segment. Omit to leave unchanged. |
| segment_id | string | yes | Identifier of the segment to update. Use nevent_list_segments to get valid segment IDs. |
No output schema declared.
No examples provided.
nevent_update_short_url ~304
Update an existing short URL's configuration. Only provided fields are changed — omitted fields remain unchanged. Changes apply immediately. Use after nevent_list_short_urls to get the `id`. Supported updates: title, expiresAt (pass null to remove expiration), isActive (true/false), tags (replaces existing), metadata (replaces existing), longUrl (changes redirect destination). Returns the updated ShortUrlDTO. WRITE operation — requires STANDARD or FULL operation mode. In READ_ONLY mode this tool returns an operation_not_permitted error immediately without making any API call.
| Name | Type | Req | Description |
|---|---|---|---|
| expiresAt | – | – | New expiration date/time (ISO 8601). Pass null to remove an existing expiration and make the link permanent. Omit this field entirely to leave expiration unchanged. |
| id | string | yes | MongoDB ObjectId of the short URL (24 hex characters). Obtain from nevent_list_short_urls response field "id". |
| isActive | boolean | – | Activate (true) or deactivate (false) the short URL. Deactivated links stop redirecting immediately. |
| longUrl | string | – | New destination URL. Changes where existing links redirect to — takes effect immediately. |
| metadata | object | – | New metadata object. Replaces (not merges) the existing metadata. |
| tags | array | – | New tag list. Replaces (not merges) the existing tags. |
| title | string | – | New descriptive title (max 200 chars). Replaces the existing title. |
No output schema declared.
No examples provided.
nevent_update_template ~214
Update an existing email template: change the name, MJML/HTML content, or tags. Call nevent_get_template first to inspect the current version before modifying. At least one of name, content, or tags must be provided. Note: updating a template does NOT retroactively change campaigns already sent with it.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | New template format: "html" or "mjml". Omit to leave unchanged. |
| html_body | string | – | New raw HTML content for the template. Omit to leave unchanged. |
| mjml_body | string | – | New MJML source code for the template. Omit to leave unchanged. |
| name | string | – | New human-readable name for the template. Omit to leave unchanged. |
| tags | array | – | Replacement list of tags. The full tag list is replaced when provided. Omit to leave existing tags unchanged. |
| template_id | string | yes | Identifier of the template to update. Use nevent_list_templates to get valid template IDs. |
No output schema declared.
No examples provided.
nevent_upload_image ~288
Upload an image to the Nevent media library and get a CDN URL. Accepts base64-encoded images as a data URL (data:image/png;base64,...) or as raw base64 with an explicit mimeType. Returns a destinationUrl (CloudFront CDN URL) that can be used directly in <img src="..."> inside email template HTML. Maximum decoded size: 5 MB. Upload the image, then reference the returned destinationUrl in nevent_update_template or nevent_create_template HTML content.
| Name | Type | Req | Description |
|---|---|---|---|
| imageName | string | – | Optional file name for the uploaded resource (e.g. "event-banner.png"). When omitted, a name is generated from the upload timestamp. |
| mimeType | string | – | MIME type of the image, e.g. "image/png" or "image/jpeg". Required when source is raw base64 (no data URL prefix). Ignored when source is a data URL (MIME type parsed from prefix). Common values: ima… |
| source | string | yes | Base64-encoded image. Two accepted forms: 1. Data URL: "data:image/png;base64,<base64data>" — MIME type parsed from prefix. 2. Raw base64 string — mimeType parameter required. Maximum decoded size: 5… |
No output schema declared.
No examples provided.
What is the Nevent MCP server?
Nevent MCP is listed in the public MCP registry as io.github.nevent-dev/mcp-nevent. Talk to your live-events CRM (campaigns, analytics, paid ads, segments) in Claude and ChatGPT. This page covers its hosted endpoint (https://mcp.nevent.ai/).
Is the Nevent MCP server safe to use?
Nevent MCP scores 78 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Nevent MCP server expose?
Nevent MCP exposes 59 tools: nevent_analytics_query, nevent_analytics_capabilities, nevent_analytics_table_schema, nevent_analytics_filter_values, nevent_campaign_report, and 54 more. Their descriptions and schemas cost roughly 11,700 tokens of context every time the server is loaded.
Does the Nevent MCP server require authentication?
No. We connected to Nevent MCP without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Nevent MCP server still maintained?
Nevent MCP is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.