EndzoneAPI
REMOTE · FOOTBALL-MCP-PRODUCTION.UP.RAILWAY.APP · SCANNED SEP 27
Pro football play-by-play, stats, injuries, and odds. REST API and MCP server. Free to start.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security83
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, but the challenge carries no valid RFC 9728 metadata, so a client cannot discover where to get a token. See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability67
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3659 tokens (~215/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 17 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.
How do I install the EndzoneAPI MCP server?
EndzoneAPI is a hosted endpoint at https://football-mcp-production.up.railway.app/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · football-mcp-production.up.railway.app
claude mcp add --transport http noahowsh-endzoneapi 'https://football-mcp-production.up.railway.app/mcp'
{
"mcpServers": {
"noahowsh-endzoneapi": {
"url": "https://football-mcp-production.up.railway.app/mcp"
}
}
} {
"servers": {
"noahowsh-endzoneapi": {
"type": "http",
"url": "https://football-mcp-production.up.railway.app/mcp"
}
}
} [mcp_servers.noahowsh-endzoneapi] url = "https://football-mcp-production.up.railway.app/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"noahowsh-endzoneapi": {
"type": "remote",
"url": "https://football-mcp-production.up.railway.app/mcp",
"enabled": true
}
}
} openclaw mcp add noahowsh-endzoneapi --url 'https://football-mcp-production.up.railway.app/mcp' --transport streamable-http
mcp_servers:
noahowsh-endzoneapi:
url: "https://football-mcp-production.up.railway.app/mcp" {
"McpServers": {
"noahowsh-endzoneapi": {
"Transport": "http",
"Url": "https://football-mcp-production.up.railway.app/mcp"
}
}
} assistant mcp add noahowsh-endzoneapi -t streamable-http -u 'https://football-mcp-production.up.railway.app/mcp'
{
"mcpServers": {
"noahowsh-endzoneapi": {
"type": "http",
"url": "https://football-mcp-production.up.railway.app/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 27 Sept 26 73
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 27 Sept 2026 · Probed https://football-mcp-production.up.railway.app/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=*.up.railway.app | CN=YE1,O=Let's Encrypt,C=US | 29 Jul 2026 | 27 Oct 2026 | ECDSA 256 | ECDSA-SHA384 | 6da79bb561da3efeb0e751ca21abd3999fe |
| SANs: *.up.railway.app, up.railway.app | ||||||
| CN=YE1,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 5ddd70dd31f801c85c186a7a04b80afe |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of football-mcp-production.up.railway.app. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| app. | present | 23684 | 8 | Verified |
| railway.app. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Challenged, unverified
The endpoint asked for a token, but we could not retrieve and validate the RFC 9728 metadata that tells a client how to obtain one.
| Result | Challenged, unverified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
Protected resource metadata
| Retrieved | No |
|---|---|
| Problem | no_resource_metadata |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://football-mcp-production.up.railway.app/mcp | Verified | 200 | |
| http (plaintext) | http://football-mcp-production.up.railway.app/mcp | HTTPS enforced | 301 | https://football-mcp-production.up.railway.app/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
get_advanced_stats ~251
Use for tracking and charting metrics the box score does not carry. Next Gen Stats (2016+): time to throw, air yards, completion percentage above expectation, separation, cushion, rush yards over expected. Pro Football Reference advanced (2018+): pressures, hurries, blitzes, drops, bad throws, missed tackles, coverage yards allowed. Pick a source, then filter by season, week, player or team. Costs 5 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max rows (default 50) |
| player_id | string | – | GSIS id for an ngs_* source, PFR id for a pfr_* source; both are on search_players |
| season | string|number | – | Season year. Defaults to current. NGS from 2016, PFR from 2018. |
| source | string | yes | Which dataset: ngs_passing, ngs_rushing, ngs_receiving, pfr_passing, pfr_rushing, pfr_receiving, pfr_defense |
| team | string | – | Team code |
| week | integer | – | Week. NGS also publishes week 0 as the season aggregate. |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | – |
| metric_keys | array | yes | – |
| note | string | – | – |
| player_id_kind | string | yes | – |
| season | number | yes | – |
| source | string | yes | – |
| stats | array | yes | – |
No examples provided.
get_depth_chart ~97
Use for a team's depth chart by week: formation, position, depth rank, player. Defaults to the latest week available. Costs 2 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| formation | string | – | Filter by formation/unit, e.g. Offense, Defense, Special Teams |
| season | string|number | – | Season year. Defaults to current. |
| team | string | yes | Team code |
| week | integer | – | Week. Defaults to latest. |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | – |
| depth_chart | array | yes | – |
| season | number | yes | – |
| team | string | yes | – |
| week | number | yes | – |
No examples provided.
get_game_detail ~91
Use when you need everything about one game: both teams, full team box-score stats (EPA, success, drives), consensus closing line, per-bookmaker opening/closing/latest odds, weather, surface, and officials. Requires a game id from get_games or get_schedule. Costs 10 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| game_id | string | yes | Game id, e.g. 2025_01_KC_BUF |
| Name | Type | Req | Description |
|---|---|---|---|
| away_team | – | yes | – |
| consensus_closing | object | yes | – |
| game | object | yes | – |
| home_team | – | yes | – |
| odds | object | yes | – |
| officials | array | yes | – |
| team_stats | object | yes | – |
No examples provided.
get_games ~203
Use when querying past or future games with filters: season, week, team, date range, game type, status. Returns scores, kickoff (UTC), venue, rest days, starting QBs, coaches, referee, and the consensus closing spread, total, and moneylines. For upcoming-only games prefer get_schedule (2 cr). Costs 5 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| date_from | string | – | Start date YYYY-MM-DD |
| date_to | string | – | End date YYYY-MM-DD |
| game_type | string | – | REG, WC, DIV, CON, SB, or POST for any playoff game |
| limit | integer | – | Max results (default 100) |
| season | string|number | – | Season year (e.g. 2025) |
| status | string | – | Game status |
| team | string | – | Team code (home or away) |
| week | integer | – | Week number (1-18 regular season; 19+ postseason) |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | – |
| filters | object | yes | – |
| games | array | yes | – |
No examples provided.
get_head_to_head ~100
Use to compare two teams' history: recent meetings with scores, the win/loss record between them, and average margin. Filter by season or get all-time. Costs 10 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max games (default 20) |
| season | string|number | – | Season year. Omit for all-time. |
| team1 | string | yes | First team code |
| team2 | string | yes | Second team code |
| Name | Type | Req | Description |
|---|---|---|---|
| avg_margin_team1 | number|null | yes | – |
| count | number | yes | – |
| games | array | yes | – |
| record | object | yes | – |
| team1 | string | yes | – |
| team2 | string | yes | – |
| total_games | number | yes | – |
No examples provided.
get_injuries ~119
Use for the official injury report: game status (Out, Doubtful, Questionable) and practice participation with the injury named, by team and week. Defaults to the latest reported week of the current season. Costs 2 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| season | string|number | – | Season year. Defaults to current. |
| status | string | – | Filter by game status: Out, Doubtful, Questionable |
| team | string | – | Team code |
| week | integer | – | Week. Defaults to the latest week with a report. |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | – |
| injuries | array | yes | – |
| season | number | yes | – |
| week | number | yes | – |
No examples provided.
get_line_movement ~78
Use to see how a game's lines moved: the full time series of hourly snapshots grouped by bookmaker. Most expensive tool (25 cr); use get_odds (10 cr) if you only need opening, closing, or current lines.
| Name | Type | Req | Description |
|---|---|---|---|
| bookmaker | string | – | Bookmaker key filter |
| game_id | string | yes | Game id |
| Name | Type | Req | Description |
|---|---|---|---|
| away_team | string | yes | – |
| game_id | string | yes | – |
| home_team | string | yes | – |
| kickoff | string|null | yes | – |
| movement | object | yes | – |
| snapshots | number | yes | – |
No examples provided.
get_odds ~155
Use for a game's betting lines: consensus closing spread/total/moneylines for every game since 1999, plus per-bookmaker opening, closing, and latest moneyline, spread, and total (DraftKings, FanDuel, BetMGM, Caesars, ESPN BET) for games from the 2026 season. Costs 10 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| bookmaker | string | – | Bookmaker key (draftkings, fanduel, betmgm, caesars, espnbet) |
| game_id | string | yes | Game id, e.g. 2026_01_KC_BUF |
| snapshot_type | string | – | Return only one snapshot type. Default returns opening, closing, and latest per book. |
| Name | Type | Req | Description |
|---|---|---|---|
| away_team | string | yes | – |
| bookmaker_count | number | yes | – |
| books | array | yes | – |
| consensus_closing | object | yes | – |
| count | number | yes | – |
| game_id | string | yes | – |
| home_team | string | yes | – |
| kickoff | string|null | yes | – |
| note | string | – | – |
No examples provided.
get_player_leaders ~214
Use to rank players on any weekly stat over a season: passing_yards, passing_tds, rushing_yards, receiving_yards, receptions, targets, def_sacks, def_interceptions, fantasy_points_ppr, passing_epa, rushing_epa, receiving_epa, and ~130 more. Counting stats are summed, rate stats averaged. Filter by position, team, minimum games. Costs 5 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max results (default 20) |
| min_games | integer | – | Minimum games with a stat line (default 1) |
| position | string | – | Position filter, e.g. QB, RB, WR, TE |
| season | string|number | – | Season year. Defaults to current. |
| season_type | string | – | Regular season (default) or postseason |
| stat | string | yes | Weekly stat column to rank by (e.g. passing_yards, receiving_epa, def_sacks) |
| team | string | – | Team code filter |
| Name | Type | Req | Description |
|---|---|---|---|
| aggregation | string | yes | – |
| count | number | yes | – |
| leaders | array | yes | – |
| season | number | yes | – |
| season_type | string | yes | – |
| stat | string | yes | – |
No examples provided.
get_player_stats ~137
Use for one player: bio, draft, physicals, headshot, id crosswalk (PFR, ESPN), summed season totals across passing, rushing, receiving, defense, kicking, returns, and fantasy points, every weekly stat line for the season, and games played per season. Defaults to the player's latest season. Costs 5 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| player_id | string | yes | GSIS player id from search_players (e.g. 00-0033873) |
| season | string|number | – | Season year. Defaults to the player's latest season. |
| season_type | string | – | Regular season (default) or postseason |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | – |
| player | object | yes | – |
| season | number | yes | – |
| season_totals | object | yes | – |
| season_type | string | yes | – |
| seasons | array | yes | – |
| weeks | array | yes | – |
No examples provided.
get_plays ~619
Use for play-by-play with nflfastR metrics: EPA, WPA, win probability, success, CPOE, air yards, formation flags, and the players involved. Filter by game, or by season plus week/team/player, plus play type, down, quarter, win-probability band, red zone, third down. Set include_charting for FTN manual charting from 2022 on -- alignment, pre-snap motion, play action, screens, run-pass options, blitzer counts, drops -- or filter directly on those flags. Returns a per-query EPA and success-rate summary. Paginate with offset. Costs 10 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| defteam | string | – | Defense team code |
| down | integer | – | Down |
| game_id | string | – | Game id, e.g. 2025_01_KC_BUF |
| include_charting | boolean | – | Attach FTN manual charting to each play (2022+): alignment, motion, play action, screens, RPO, blitzers, drops |
| is_drop | boolean | – | Charting filter: charted drop (2022+) |
| is_motion | boolean | – | Charting filter: pre-snap motion (2022+) |
| is_no_huddle | boolean | – | Charting filter: no huddle (2022+) |
| is_play_action | boolean | – | Charting filter: play action (2022+) |
| is_qb_out_of_pocket | boolean | – | Charting filter: quarterback out of the pocket (2022+) |
| is_rpo | boolean | – | Charting filter: run-pass option (2022+) |
| is_screen_pass | boolean | – | Charting filter: screen pass (2022+) |
| is_trick_play | boolean | – | Charting filter: trick play (2022+) |
| limit | integer | – | Max plays (default 200) |
| max_wp | number | – | Maximum pre-play win probability |
| min_blitzers | integer | – | Charting filter: at least this many blitzers (2022+). FTN counts rushers beyond the base rush, so this is typically 0-3; 5+ is almost never charted. |
| min_wp | number | – | Minimum pre-play win probability for the offense |
| offset | integer | – | Pagination offset |
| passer_id | string | – | GSIS id of the passer |
| play_type | string | – | Play type |
| posteam | string | – | Offense team code |
| quarter | integer | – | Quarter (5+ = overtime) |
| receiver_id | string | – | GSIS id of the receiver |
| red_zone | boolean | – | Only plays inside the 20 |
| rusher_id | string | – | GSIS id of the rusher |
| season | string|number | – | Season year (required when game_id is not set) |
| third_down | boolean | – | Only third downs |
| week | integer | – | Week |
| Name | Type | Req | Description |
|---|---|---|---|
| charted_plays | number | – | – |
| count | number | yes | – |
| next_offset | number|null | yes | – |
| note | string | – | – |
| plays | array | yes | – |
| summary | object | yes | – |
No examples provided.
get_schedule ~104
Use to see what is coming up: unplayed games in the next N days (default 7), or a specific week of the current season. Includes consensus lines where posted. Costs 2 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Days ahead to look when week is not set (default 7) |
| team | string | – | Team code to filter |
| week | integer | – | A specific week of the current season (returns all games that week, played or not) |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | – |
| days | number|null | yes | – |
| season | number | yes | – |
| upcoming_games | array | yes | – |
| week | number|null | yes | – |
No examples provided.
get_snap_counts ~136
Use for playing time: offensive, defensive, and special-teams snaps and snap shares, for one game, one player (PFR id), or a team's season. Costs 5 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| game_id | string | – | Game id, e.g. 2025_01_KC_BUF |
| limit | integer | – | Max rows (default 200) |
| player_id | string | – | PFR player id (from search_players pfr_id) |
| season | string|number | – | Season year (with team or player) |
| team | string | – | Team code |
| week | integer | – | Week filter |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | – |
| filters | object | yes | – |
| note | string | – | – |
| snap_counts | array | yes | – |
No examples provided.
get_standings ~137
Use for regular-season standings and playoff seeding: record, win%, points for/against, home/away/division/conference records, streak, division rank, and conference seed. Ranks apply the real NFL tiebreaking procedure and report which step decided each one. Computed from final scores. Defaults to the current season. Costs 2 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| conference | string | – | Filter by conference |
| division | string | – | Filter by division, e.g. 'NFC North' |
| season | string|number | – | Season year the regular season starts (e.g. 2025). Defaults to current. |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | – |
| note | string | – | – |
| season | number | yes | – |
| standings | array | yes | – |
No examples provided.
get_team_stats ~110
Use for one team's season: totals (passing, rushing, receiving, defense, kicking, penalties), EPA per play, yards per attempt/carry, the standings row, and every weekly stat line. Costs 5 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| season | string|number | – | Season year (e.g. 2025). Defaults to current. |
| season_type | string | – | Regular season (default) or postseason |
| team | string | yes | Team code (e.g. KC, BUF, PHI) |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | – |
| record | – | yes | – |
| season | number | yes | – |
| season_type | string | yes | – |
| team | – | yes | – |
| totals | object | yes | – |
| weeks | array | yes | – |
No examples provided.
list_teams ~90
Use when you need team codes, or all 32 current teams with conference, division, colours, and logo URLs. Team codes are nflverse spelling (LA for the Rams, WAS for Washington). Cheapest tool at 1 credit.
| Name | Type | Req | Description |
|---|---|---|---|
| conference | string | – | Filter by conference |
| division | string | – | Filter by division, e.g. 'AFC East' or 'NFC West' |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | – |
| teams | array | yes | – |
No examples provided.
search_players ~170
Use to find a player by name (partial match). Searches ~25,000 players back to 1999; returns current-season players by default, falling back to all players back to 1999 when none match. Returns the GSIS player id needed by get_player_stats. Costs 2 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| active | boolean | – | Default true, but an active-only search that finds nobody automatically falls back to all players and says so. Set false to search everyone outright. |
| limit | integer | – | Max results (default 10) |
| position | string | – | Filter by position (e.g. QB, RB, WR, TE, OL, DL, LB, DB) |
| query | string | yes | Player name or part of it |
| team | string | – | Filter by current team code |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | – |
| included_inactive | boolean | yes | – |
| note | string | – | – |
| players | array | yes | – |
No examples provided.
What is the EndzoneAPI MCP server?
EndzoneAPI is an MCP server listed in the public MCP registry as io.github.noahowsh/endzoneapi. Pro football play-by-play, stats, injuries, and odds. REST API and MCP server. Free to start. This page covers its hosted endpoint (https://football-mcp-production.up.railway.app/mcp).
Is the EndzoneAPI MCP server safe to use?
EndzoneAPI scores 73 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the EndzoneAPI MCP server expose?
EndzoneAPI exposes 17 tools: list_teams, get_standings, get_team_stats, get_games, get_schedule, and 12 more. Their descriptions and schemas cost roughly 2,811 tokens of context every time the server is loaded.
Does the EndzoneAPI MCP server require authentication?
Yes. EndzoneAPI asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the EndzoneAPI MCP server still maintained?
EndzoneAPI is still listed as active in the MCP registry. We last reached this channel on 27 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.