Rove
REMOTE · API.ROVEAPI.COM · 2 COMPONENTS
Rove — supervised browser for AI agents. Your agent drives; a human watches, takes over.
Available components
Last scanned (7 hours ago)
Scores higher than 28% of remote servers
Reachable. Last reached 5 Nov 2026.
Category Browser Automation
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security94
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- The endpoint enforces authorisation, advertised via RFC 9728 protected-resource metadata. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. View diagnostics → Partial
Transport & Reachability0
- Transport blocked by authentication: the endpoint requires auth we don't have to verify streamable-http. See how to fix → View diagnostics → Unverified
Schema Quality & AI Usability0
- Schema blocked by authentication: the endpoint requires auth we don't have to read it. See how to fix → Unverified
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage0
- Tool coverage blocked by authentication: the endpoint requires auth we don't have to read its tools.Unverified
Tool Safety0
- Tool safety blocked by authentication: the endpoint requires auth we don't have to read its tools.Unverified
Capabilities0
- Capabilities blocked by authentication: the endpoint requires auth we don't have to read them. See how to fix → Unverified
Unverified: 6 categories
Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm. Claim this server and supply a read-only token to verify it and lift the score.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 1 Nov 26 +2
- HSTS header: fail → pass ▲ security
- 17 Oct 26 −28
- Endpoint reachability: reachable → behind authorisation ▼ security
- Transport: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Stability: 0.10 → unverified ▼ security
- Authorization: fail → pass ▲ security
- First check of Authorization: partial security
- Tool coverage: 100 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- First check of Schema quality: unverified functional
- 15 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Oct 26 0
- Stability: unverified → 0.03 ▲ functional
- 13 Oct 26 63
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://api.roveapi.com/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=roveapi.com | CN=YE2,O=Let's Encrypt,C=US | 28 Sept 2026 | 27 Dec 2026 | ECDSA 256 | ECDSA-SHA384 | 6af34aaeef5114b42ddde2f77abb2aa53ca |
| SANs: *.roveapi.com, roveapi.com | ||||||
| CN=YE2,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 4df3b15dd6c0784c507cd37b58e6f115 |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of api.roveapi.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| roveapi.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On connection |
| HTTP status | 401 |
WWW-Authenticate challenge Bearer resource_metadata="https://api.roveapi.com/.well-known/oauth-protected-resource", scope="rove:browse rove:supervised"
Bearer resource_metadata="https://api.roveapi.com/.well-known/oauth-protected-resource", scope="rove:browse rove:supervised"| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains |
| www-authenticate | Bearer resource_metadata="https://api.roveapi.com/.well-known/oauth-protected-resource", scope="rove:browse rove:supervised" |
Protected resource metadata
| Document | https://api.roveapi.com/.well-known/oauth-protected-resource |
|---|---|
| Retrieved | Yes |
| Resource | https://api.roveapi.com/mcp |
| Authorisation server | https://api.roveapi.com |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://api.roveapi.com/mcp | Auth required | 401 | |
| http (plaintext) | http://api.roveapi.com/mcp | HTTPS enforced | 301 | https://api.roveapi.com/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
account_info ~21
Check your account status: credits balance, plan, and usage.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
authenticate ~42
Authenticate this MCP session. Sends a magic link to your email — click it to activate. Required before using any other tool.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | Your email address |
No output schema declared.
No examples provided.
buy_credits ~251
Without arguments: shows Rove credit prices and whether this key may buy. With item_id: buys that credit pack and may charge the account owner's saved card, or returns a payment link for a person, within limits the owner set. Pass the same idempotency_key when retrying the same purchase. Without idempotency_key, the same call again in this MCP session returns the first purchase for 10 to 20 minutes; to buy the same pack twice on purpose, pass a new idempotency_key each time.
| Name | Type | Req | Description |
|---|---|---|---|
| idempotency_key | string | – | The idempotency_key an earlier buy_credits result returned, to retry that same purchase. Use a new one for a new purchase. 1-128 characters of A-Z a-z 0-9 _ . : - |
| item_id | string | – | A pack id from top_ups or get_credit_catalogue, e.g. pack_1k. Omit it to see prices without buying. |
| payment | string | – | auto (default): charge the saved card when the owner allowed it, else return a payment link for a person; checkout: always a payment link; saved_method: only the saved card. |
No output schema declared.
No examples provided.
cancel_purchase ~44
Cancels an unpaid purchase this key made, so its payment link stops working.
| Name | Type | Req | Description |
|---|---|---|---|
| purchase_id | string | yes | The purchase id, from buy_credits or list_purchases. |
No output schema declared.
No examples provided.
clear_history ~44
Delete this API key's supervised browsing history. Cookies, storage and open-pages restore are kept. Refused (profile-busy) while a supervised session on this key is running.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
click ~260
Click an element by CSS selector, accessible label or a11y tree ref. In a supervised session, a click that opens a popup makes the popup the current page.
| Name | Type | Req | Description |
|---|---|---|---|
| button | string | – | Mouse button to click with. Default: "left". |
| click_count | number | – | Number of clicks (e.g. 2 for double-click). Default: 1. |
| frame | – | – | A CSS selector for an iframe, or a list of them for nested iframes. selector, label and ref then resolve inside it. |
| label | string | – | Accessible name or visible text to click by (e.g. "Sign in"). Alternative to selector. |
| page_id | string | – | The page to act on, from list_pages or pages_opened. Defaults to the current page. Does not change the current page. |
| ref | string | – | An element ref from this page's latest get_a11y_tree, such as e5, or f1e3 inside an iframe. |
| selector | string | – | CSS selector of the element to click. Either selector, label or ref is required. |
| session_id | string | yes | Browser session ID |
| wait_after_ms | number | – | Milliseconds to wait after clicking before returning. |
No output schema declared.
No examples provided.
close_page ~63
Close an open page. If it was current, the session returns to the page that was current when it opened. The last open page cannot be closed.
| Name | Type | Req | Description |
|---|---|---|---|
| page_id | string | yes | The open page to close. |
| session_id | string | yes | Browser session ID |
No output schema declared.
No examples provided.
close_session ~27
Close a browser session and release resources.
| Name | Type | Req | Description |
|---|---|---|---|
| session_id | string | yes | Browser session ID |
No output schema declared.
No examples provided.
delete_profile ~52
Delete this API key's whole supervised browser profile: cookies, storage, history and any restore offer. The next session starts signed out. Refused (profile-busy) while a supervised session on this key is running.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
evaluate ~84
Execute JavaScript in the browser context.
| Name | Type | Req | Description |
|---|---|---|---|
| expression | string | yes | JavaScript expression to evaluate in the page context. The return value is serialized as JSON. |
| page_id | string | – | The page to act on, from list_pages or pages_opened. Defaults to the current page. Does not change the current page. |
| session_id | string | yes | Browser session ID |
No output schema declared.
No examples provided.
fill ~198
Fill a form field with text. By default clears existing value first.
| Name | Type | Req | Description |
|---|---|---|---|
| clear_first | boolean | – | Clear the existing value before typing. Default: true. |
| frame | – | – | A CSS selector for an iframe, or a list of them for nested iframes. selector, label and ref then resolve inside it. |
| label | string | – | Accessible label of the input. Alternative to selector. |
| page_id | string | – | The page to act on, from list_pages or pages_opened. Defaults to the current page. Does not change the current page. |
| ref | string | – | An element ref from this page's latest get_a11y_tree, such as e5, or f1e3 inside an iframe. |
| selector | string | – | CSS selector of the input element. Either selector, label or ref is required. |
| session_id | string | yes | Browser session ID |
| value | string | yes | Text to fill |
No output schema declared.
No examples provided.
get_a11y_tree ~280
Get the accessibility tree snapshot of the current page. Returns structured data 77% smaller than a screenshot. Auto-scopes to the main content area on large pages (50K+ chars). Use selector to manually scope to a specific element.
| Name | Type | Req | Description |
|---|---|---|---|
| exclude_selectors | array | – | CSS selectors to exclude from the tree (e.g. ["nav", "footer", ".ad-slot"]). Elements are hidden before snapshotting. |
| frame | – | – | A CSS selector for an iframe, or a list of them for nested iframes. selector, label and ref then resolve inside it. |
| max_chars | number | – | Maximum characters to return. Truncates at nearest line boundary. |
| max_depth | number | – | Maximum tree depth. Limits nesting to get a structural overview without deep details. |
| page_id | string | – | The page to act on, from list_pages or pages_opened. Defaults to the current page. Does not change the current page. |
| selector | string | – | CSS selector to scope the tree to a specific element (e.g. "#search-results", "main"). If omitted on large pages, auto-scopes to the main landmark. |
| session_id | string | yes | Browser session ID |
| visible_only | boolean | – | Only include visible elements. Skips hidden menus, modals, and offscreen content. |
No output schema declared.
No examples provided.
get_credit_balance ~34
Shows this account's credits, exact to the millicredit, and whether this key may buy more and within what limits.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_credit_catalogue ~30
Shows Rove credit packs, subscription tiers and what an action or supervised minute costs. Never buys.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_purchase ~50
Shows one purchase this key made and what to do next (for example, a payment link for a person).
| Name | Type | Req | Description |
|---|---|---|---|
| purchase_id | string | yes | The purchase id, from buy_credits or list_purchases. |
No output schema declared.
No examples provided.
get_text ~162
Extract text content from an element.
| Name | Type | Req | Description |
|---|---|---|---|
| frame | – | – | A CSS selector for an iframe, or a list of them for nested iframes. selector, label and ref then resolve inside it. |
| page_id | string | – | The page to act on, from list_pages or pages_opened. Defaults to the current page. Does not change the current page. |
| ref | string | – | An element ref from this page's latest get_a11y_tree, such as e5, or f1e3 inside an iframe. |
| selector | string | – | CSS selector. Either selector or ref is required. |
| session_id | string | yes | Browser session ID |
| trim | boolean | – | Trim leading/trailing whitespace from the extracted text. Default: true. |
No output schema declared.
No examples provided.
list_history ~125
List the pages this API key's supervised browser profile visited, newest first, across sessions: URL, title, time, session id and whether the agent or a human held control. Sign-in callback codes and tokens are never stored. To reopen an entry, navigate to its url.
| Name | Type | Req | Description |
|---|---|---|---|
| before | string | – | An entry_id from an earlier page (next_before): return older entries. |
| limit | number | – | How many entries to return. Default 50, maximum 200. |
| query | string | – | Only entries whose URL or title contains this text (case-insensitive). |
No output schema declared.
No examples provided.
list_pages ~85
List the pages open in this session's browser, with page ids, opener, URL, title and status, and which page is current. Popups the page opened appear here. Does not count as a fresh observation.
| Name | Type | Req | Description |
|---|---|---|---|
| after_seq | number | – | Report page events after this seq. Default: since the previous list_pages. |
| session_id | string | yes | Browser session ID |
No output schema declared.
No examples provided.
list_purchases ~57
Lists purchases this key made, newest first.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | next_cursor from an earlier page: return older purchases. |
| limit | number | – | How many purchases to return, 1 to 100. Default 20. |
No output schema declared.
No examples provided.
list_sessions ~14
List all active browser sessions.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
navigate ~120
Navigate to a URL. Creates a browser session automatically if none exists.
| Name | Type | Req | Description |
|---|---|---|---|
| page_id | string | – | The page to act on, from list_pages or pages_opened. Defaults to the current page. Does not change the current page. |
| session_id | string | – | Reuse an existing session (optional) |
| timeout_ms | number | – | Navigation timeout in milliseconds. Default: 30000. |
| url | string | yes | Full URL to navigate to |
| wait_until | string | – | Page lifecycle event to wait for. Default: "networkidle". |
No output schema declared.
No examples provided.
restore_pages ~109
Answer a supervised session's restore offer. When the previous session on this profile ended unexpectedly (crash, hang or restart), list_pages and the session status carry restore.available and the pages that were open; nothing reopens until you choose. restore reopens them (each through the target policy) and makes the recorded current page current; dismiss drops the offer.
| Name | Type | Req | Description |
|---|---|---|---|
| decision | string | yes | restore reopens the offered pages; dismiss drops the offer. |
| session_id | string | yes | Browser session ID |
No output schema declared.
No examples provided.
screenshot ~179
Take a screenshot of the current page or a specific element.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | Image format. Default: "png". |
| frame | – | – | A CSS selector for an iframe, or a list of them for nested iframes. selector, label and ref then resolve inside it. |
| full_page | boolean | – | Capture full scrollable page (default: false) |
| page_id | string | – | The page to act on, from list_pages or pages_opened. Defaults to the current page. Does not change the current page. |
| ref | string | – | An element ref from this page's latest get_a11y_tree, such as e5, or f1e3 inside an iframe. |
| selector | string | – | CSS selector to screenshot a specific element instead of the page. |
| session_id | string | yes | Browser session ID |
No output schema declared.
No examples provided.
scroll ~178
Scroll the page in a direction, or scroll a specific element.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | number | – | Pixels to scroll (default: 500) |
| direction | string | yes | Scroll direction |
| frame | – | – | A CSS selector for an iframe, or a list of them for nested iframes. selector, label and ref then resolve inside it. |
| page_id | string | – | The page to act on, from list_pages or pages_opened. Defaults to the current page. Does not change the current page. |
| ref | string | – | An element ref from this page's latest get_a11y_tree, such as e5, or f1e3 inside an iframe. |
| selector | string | – | CSS selector of a scrollable element. If omitted, the window is scrolled. |
| session_id | string | yes | Browser session ID |
No output schema declared.
No examples provided.
simulate_purchase ~63
Test keys only: moves a simulated purchase to paid, expired, failed or needs-authentication. Never charges.
| Name | Type | Req | Description |
|---|---|---|---|
| outcome | string | yes | What happens to the simulated payment. |
| purchase_id | string | yes | The purchase id, from buy_credits or list_purchases. |
No output schema declared.
No examples provided.
switch_page ~66
Make another open page current. Later actions without page_id run on it, and in a supervised session the viewer shows it.
| Name | Type | Req | Description |
|---|---|---|---|
| page_id | string | yes | The open page to make current, from list_pages or pages_opened. |
| session_id | string | yes | Browser session ID |
No output schema declared.
No examples provided.
wait_for_popup ~163
Wait for a popup opened by your last navigate, click, fill, scroll or evaluate, even one that has already opened, and return its page_id. In a supervised session the popup becomes current. In other sessions, call switch_page or pass page_id. A popup Rove blocks answers popup-blocked at once instead of waiting. After a human returns control, a popup they opened counts; pass after_seq to wait for a newer one.
| Name | Type | Req | Description |
|---|---|---|---|
| after_seq | number | – | Wait for a popup after this page event seq, such as an earlier result's page_events_seq_start. |
| session_id | string | yes | Browser session ID |
| timeout_ms | number | – | How long to wait, in milliseconds. Default: 10000; maximum 30000. |
No output schema declared.
No examples provided.
How do I install the Rove MCP server?
Rove is a hosted endpoint at https://api.roveapi.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · api.roveapi.com
claude mcp add --transport http noncelogic-rove 'https://api.roveapi.com/mcp'
What is the Rove MCP server?
Rove is an MCP server listed in the public MCP registry as io.github.noncelogic/rove. Rove, supervised browser for AI agents. Your agent drives; a human watches, takes over. This page covers its hosted endpoint (https://api.roveapi.com/mcp).
Is the Rove MCP server safe to use?
Rove scores 38 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Rove MCP server expose?
Rove exposes 27 tools: navigate, click, fill, screenshot, get_a11y_tree, and 22 more. Their descriptions and schemas cost roughly 2,801 tokens of context every time the server is loaded.
Does the Rove MCP server require authentication?
Yes. Rove asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the Rove MCP server still maintained?
Rove is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.