# Rove (remote · api.roveapi.com)

Rove — supervised browser for AI agents. Your agent drives; a human watches, takes over.

- Trust score: 38/100 (low)
- Change this week: +2
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `api.roveapi.com`: 38/100 (this document), [markdown](https://verifymcp.io/servers/noncelogic-rove/api.md), [page](https://verifymcp.io/servers/noncelogic-rove/api)
- npm · `@roveapi/mcp`: 74/100, [markdown](https://verifymcp.io/servers/noncelogic-rove/roveapi-mcp.md), [page](https://verifymcp.io/servers/noncelogic-rove/roveapi-mcp)

## Channel facts

- Endpoint: `https://api.roveapi.com/mcp`
- Transports: `streamable-http`
- Auth: `required`
- Version: `1.18.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 94/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - The endpoint enforces authorisation, advertised via RFC 9728 protected-resource metadata.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
  - The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents.
- **Transport & Reachability**: 0/100
  - Transport blocked by authentication: the endpoint requires auth we don't have to verify streamable-http.
- **Schema Quality & AI Usability**: 0/100
  - Schema blocked by authentication: the endpoint requires auth we don't have to read it.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 0/100
  - Tool coverage blocked by authentication: the endpoint requires auth we don't have to read its tools.
- **Tool Safety**: 0/100
  - Tool safety blocked by authentication: the endpoint requires auth we don't have to read its tools.
- **Capabilities**: 0/100
  - Capabilities blocked by authentication: the endpoint requires auth we don't have to read them.

**Unverified: 6 categories.** Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.

## Install

### How do I install the Rove MCP server?

Rove is a hosted endpoint at https://api.roveapi.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http noncelogic-rove 'https://api.roveapi.com/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "noncelogic-rove": {
      "url": "https://api.roveapi.com/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "noncelogic-rove": {
      "type": "http",
      "url": "https://api.roveapi.com/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.noncelogic-rove]
url = "https://api.roveapi.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "noncelogic-rove": {
      "type": "remote",
      "url": "https://api.roveapi.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add noncelogic-rove --url 'https://api.roveapi.com/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  noncelogic-rove:
    url: "https://api.roveapi.com/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "noncelogic-rove": {
      "Transport": "http",
      "Url": "https://api.roveapi.com/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add noncelogic-rove -t streamable-http -u 'https://api.roveapi.com/mcp'
```

### Other

```json
{
  "mcpServers": {
    "noncelogic-rove": {
      "type": "http",
      "url": "https://api.roveapi.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-01 (score 38, +2)

- [security improvement] HSTS header: fail → pass

### 2026-10-17 (score 36, −28)

- [security regression] Endpoint reachability: reachable → behind authorisation
- [security regression] Transport: pass → unverified
- [security regression] Tool safety: pass → unverified
- [security regression] Stability: 0.10 → unverified
- [security improvement] Authorization: fail → pass
- [security] First check of Authorization: partial
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Capabilities: pass → unverified
- [functional] First check of Schema quality: unverified

### 2026-10-15 (score 64, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-14 (score 63, 0)

- [functional improvement] Stability: unverified → 0.03

### 2026-10-13 (score 63)

First indexed and scored.

## MCP tools (27)

### `navigate` (~120 tokens)

Navigate to a URL. Creates a browser session automatically if none exists.

Input parameters:

- `page_id` (string): The page to act on, from list_pages or pages_opened. Defaults to the current page. Does not change the current page.
- `session_id` (string): Reuse an existing session (optional)
- `timeout_ms` (number): Navigation timeout in milliseconds. Default: 30000.
- `url` (string, required): Full URL to navigate to
- `wait_until` (string): Page lifecycle event to wait for. Default: "networkidle".

### `click` (~260 tokens)

Click an element by CSS selector, accessible label or a11y tree ref. In a supervised session, a click that opens a popup makes the popup the current page.

Input parameters:

- `button` (string): Mouse button to click with. Default: "left".
- `click_count` (number): Number of clicks (e.g. 2 for double-click). Default: 1.
- `frame`: A CSS selector for an iframe, or a list of them for nested iframes. selector, label and ref then resolve inside it.
- `label` (string): Accessible name or visible text to click by (e.g. "Sign in"). Alternative to selector.
- `page_id` (string): The page to act on, from list_pages or pages_opened. Defaults to the current page. Does not change the current page.
- `ref` (string): An element ref from this page's latest get_a11y_tree, such as e5, or f1e3 inside an iframe.
- `selector` (string): CSS selector of the element to click. Either selector, label or ref is required.
- `session_id` (string, required): Browser session ID
- `wait_after_ms` (number): Milliseconds to wait after clicking before returning.

### `fill` (~198 tokens)

Fill a form field with text. By default clears existing value first.

Input parameters:

- `clear_first` (boolean): Clear the existing value before typing. Default: true.
- `frame`: A CSS selector for an iframe, or a list of them for nested iframes. selector, label and ref then resolve inside it.
- `label` (string): Accessible label of the input. Alternative to selector.
- `page_id` (string): The page to act on, from list_pages or pages_opened. Defaults to the current page. Does not change the current page.
- `ref` (string): An element ref from this page's latest get_a11y_tree, such as e5, or f1e3 inside an iframe.
- `selector` (string): CSS selector of the input element. Either selector, label or ref is required.
- `session_id` (string, required): Browser session ID
- `value` (string, required): Text to fill

### `screenshot` (~179 tokens)

Take a screenshot of the current page or a specific element.

Input parameters:

- `format` (string): Image format. Default: "png".
- `frame`: A CSS selector for an iframe, or a list of them for nested iframes. selector, label and ref then resolve inside it.
- `full_page` (boolean): Capture full scrollable page (default: false)
- `page_id` (string): The page to act on, from list_pages or pages_opened. Defaults to the current page. Does not change the current page.
- `ref` (string): An element ref from this page's latest get_a11y_tree, such as e5, or f1e3 inside an iframe.
- `selector` (string): CSS selector to screenshot a specific element instead of the page.
- `session_id` (string, required): Browser session ID

### `get_a11y_tree` (~280 tokens)

Get the accessibility tree snapshot of the current page. Returns structured data 77% smaller than a screenshot. Auto-scopes to the main content area on large pages (50K+ chars). Use selector to manually scope to a specific element.

Input parameters:

- `exclude_selectors` (array): CSS selectors to exclude from the tree (e.g. ["nav", "footer", ".ad-slot"]). Elements are hidden before snapshotting.
- `frame`: A CSS selector for an iframe, or a list of them for nested iframes. selector, label and ref then resolve inside it.
- `max_chars` (number): Maximum characters to return. Truncates at nearest line boundary.
- `max_depth` (number): Maximum tree depth. Limits nesting to get a structural overview without deep details.
- `page_id` (string): The page to act on, from list_pages or pages_opened. Defaults to the current page. Does not change the current page.
- `selector` (string): CSS selector to scope the tree to a specific element (e.g. "#search-results", "main"). If omitted on large pages, auto-scopes to the main landmark.
- `session_id` (string, required): Browser session ID
- `visible_only` (boolean): Only include visible elements. Skips hidden menus, modals, and offscreen content.

### `get_text` (~162 tokens)

Extract text content from an element.

Input parameters:

- `frame`: A CSS selector for an iframe, or a list of them for nested iframes. selector, label and ref then resolve inside it.
- `page_id` (string): The page to act on, from list_pages or pages_opened. Defaults to the current page. Does not change the current page.
- `ref` (string): An element ref from this page's latest get_a11y_tree, such as e5, or f1e3 inside an iframe.
- `selector` (string): CSS selector. Either selector or ref is required.
- `session_id` (string, required): Browser session ID
- `trim` (boolean): Trim leading/trailing whitespace from the extracted text. Default: true.

### `scroll` (~178 tokens)

Scroll the page in a direction, or scroll a specific element.

Input parameters:

- `amount` (number): Pixels to scroll (default: 500)
- `direction` (string, required): Scroll direction
- `frame`: A CSS selector for an iframe, or a list of them for nested iframes. selector, label and ref then resolve inside it.
- `page_id` (string): The page to act on, from list_pages or pages_opened. Defaults to the current page. Does not change the current page.
- `ref` (string): An element ref from this page's latest get_a11y_tree, such as e5, or f1e3 inside an iframe.
- `selector` (string): CSS selector of a scrollable element. If omitted, the window is scrolled.
- `session_id` (string, required): Browser session ID

### `evaluate` (~84 tokens)

Execute JavaScript in the browser context.

Input parameters:

- `expression` (string, required): JavaScript expression to evaluate in the page context. The return value is serialized as JSON.
- `page_id` (string): The page to act on, from list_pages or pages_opened. Defaults to the current page. Does not change the current page.
- `session_id` (string, required): Browser session ID

### `list_pages` (~85 tokens)

List the pages open in this session's browser, with page ids, opener, URL, title and status, and which page is current. Popups the page opened appear here. Does not count as a fresh observation.

Input parameters:

- `after_seq` (number): Report page events after this seq. Default: since the previous list_pages.
- `session_id` (string, required): Browser session ID

### `switch_page` (~66 tokens)

Make another open page current. Later actions without page_id run on it, and in a supervised session the viewer shows it.

Input parameters:

- `page_id` (string, required): The open page to make current, from list_pages or pages_opened.
- `session_id` (string, required): Browser session ID

### `close_page` (~63 tokens)

Close an open page. If it was current, the session returns to the page that was current when it opened. The last open page cannot be closed.

Input parameters:

- `page_id` (string, required): The open page to close.
- `session_id` (string, required): Browser session ID

### `wait_for_popup` (~163 tokens)

Wait for a popup opened by your last navigate, click, fill, scroll or evaluate, even one that has already opened, and return its page_id. In a supervised session the popup becomes current. In other sessions, call switch_page or pass page_id. A popup Rove blocks answers popup-blocked at once instead of waiting. After a human returns control, a popup they opened counts; pass after_seq to wait for a newer one.

Input parameters:

- `after_seq` (number): Wait for a popup after this page event seq, such as an earlier result's page_events_seq_start.
- `session_id` (string, required): Browser session ID
- `timeout_ms` (number): How long to wait, in milliseconds. Default: 10000; maximum 30000.

### `list_history` (~125 tokens)

List the pages this API key's supervised browser profile visited, newest first, across sessions: URL, title, time, session id and whether the agent or a human held control. Sign-in callback codes and tokens are never stored. To reopen an entry, navigate to its url.

Input parameters:

- `before` (string): An entry_id from an earlier page (next_before): return older entries.
- `limit` (number): How many entries to return. Default 50, maximum 200.
- `query` (string): Only entries whose URL or title contains this text (case-insensitive).

### `restore_pages` (~109 tokens)

Answer a supervised session's restore offer. When the previous session on this profile ended unexpectedly (crash, hang or restart), list_pages and the session status carry restore.available and the pages that were open; nothing reopens until you choose. restore reopens them (each through the target policy) and makes the recorded current page current; dismiss drops the offer.

Input parameters:

- `decision` (string, required): restore reopens the offered pages; dismiss drops the offer.
- `session_id` (string, required): Browser session ID

### `clear_history` (~44 tokens)

Delete this API key's supervised browsing history. Cookies, storage and open-pages restore are kept. Refused (profile-busy) while a supervised session on this key is running.

### `delete_profile` (~52 tokens)

Delete this API key's whole supervised browser profile: cookies, storage, history and any restore offer. The next session starts signed out. Refused (profile-busy) while a supervised session on this key is running.

### `close_session` (~27 tokens)

Close a browser session and release resources.

Input parameters:

- `session_id` (string, required): Browser session ID

### `list_sessions` (~14 tokens)

List all active browser sessions.

### `authenticate` (~42 tokens)

Authenticate this MCP session. Sends a magic link to your email — click it to activate. Required before using any other tool.

Input parameters:

- `email` (string, required): Your email address

### `account_info` (~21 tokens)

Check your account status: credits balance, plan, and usage.

### `buy_credits` (~251 tokens)

Without arguments: shows Rove credit prices and whether this key may buy. With item_id: buys that credit pack and may charge the account owner's saved card, or returns a payment link for a person, within limits the owner set. Pass the same idempotency_key when retrying the same purchase. Without idempotency_key, the same call again in this MCP session returns the first purchase for 10 to 20 minutes; to buy the same pack twice on purpose, pass a new idempotency_key each time.

Input parameters:

- `idempotency_key` (string): The idempotency_key an earlier buy_credits result returned, to retry that same purchase. Use a new one for a new purchase. 1-128 characters of A-Z a-z 0-9 _ . : -
- `item_id` (string): A pack id from top_ups or get_credit_catalogue, e.g. pack_1k. Omit it to see prices without buying.
- `payment` (string): auto (default): charge the saved card when the owner allowed it, else return a payment link for a person; checkout: always a payment link; saved_method: only the saved card.

### `get_credit_catalogue` (~30 tokens)

Shows Rove credit packs, subscription tiers and what an action or supervised minute costs. Never buys.

### `get_credit_balance` (~34 tokens)

Shows this account's credits, exact to the millicredit, and whether this key may buy more and within what limits.

### `get_purchase` (~50 tokens)

Shows one purchase this key made and what to do next (for example, a payment link for a person).

Input parameters:

- `purchase_id` (string, required): The purchase id, from buy_credits or list_purchases.

### `list_purchases` (~57 tokens)

Lists purchases this key made, newest first.

Input parameters:

- `cursor` (string): next_cursor from an earlier page: return older purchases.
- `limit` (number): How many purchases to return, 1 to 100. Default 20.

### `cancel_purchase` (~44 tokens)

Cancels an unpaid purchase this key made, so its payment link stops working.

Input parameters:

- `purchase_id` (string, required): The purchase id, from buy_credits or list_purchases.

### `simulate_purchase` (~63 tokens)

Test keys only: moves a simulated purchase to paid, expired, failed or needs-authentication. Never charges.

Input parameters:

- `outcome` (string, required): What happens to the simulated payment.
- `purchase_id` (string, required): The purchase id, from buy_credits or list_purchases.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/noncelogic-rove/api#diagnostics

## Score history

- 2026-11-05: 38
- 2026-11-04: 38
- 2026-11-03: 38
- 2026-11-02: 38
- 2026-11-01: 38
- 2026-10-31: 36
- 2026-10-30: 36
- 2026-10-29: 36
- 2026-10-28: 36
- 2026-10-27: 36
- 2026-10-26: 36
- 2026-10-25: 36
- 2026-10-24: 36
- 2026-10-23: 36
- 2026-10-22: 36
- 2026-10-21: 36
- 2026-10-20: 36
- 2026-10-19: 36
- 2026-10-18: 36
- 2026-10-17: 36
- 2026-10-16: 64
- 2026-10-15: 64
- 2026-10-14: 63
- 2026-10-13: 63

## Common questions

### What is the Rove MCP server?

Rove is an MCP server listed in the public MCP registry as io.github.noncelogic/rove. Rove, supervised browser for AI agents. Your agent drives; a human watches, takes over. This page covers its hosted endpoint (https://api.roveapi.com/mcp).

### Is the Rove MCP server safe to use?

Rove scores 38 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Rove MCP server expose?

Rove exposes 27 tools: navigate, click, fill, screenshot, get_a11y_tree, and 22 more. Their descriptions and schemas cost roughly 2,801 tokens of context every time the server is loaded.

### Does the Rove MCP server require authentication?

Yes. Rove asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

### Is the Rove MCP server still maintained?

Rove is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What did VerifyMCP test on the Rove MCP server?

VerifyMCP ran 5 checks on Rove, covering TLS certificate, Authorization, HTTPS, HSTS header and 1 more. 6 items could not be completed, a gap on our side rather than a finding about Rove: Transport, Schema quality, Stability, Tool coverage and 2 more. 6 categories score 0 for that reason, because we only credit what we can confirm. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.

## Links

- Remote endpoint: https://api.roveapi.com/mcp
- Authorisation metadata: https://api.roveapi.com/.well-known/oauth-protected-resource/mcp
- Website: https://roveapi.com/
- Changelog RSS feed: https://verifymcp.io/servers/noncelogic-rove/api.xml
- Changelog JSON feed: https://verifymcp.io/servers/noncelogic-rove/api/changelog.json
- Trust report (JSON): https://verifymcp.io/servers/noncelogic-rove/api.json
- HTML version of this page: https://verifymcp.io/servers/noncelogic-rove/api