# Piloxa (remote · piloxa.com) Prepare USPS Certified Mail letters from any AI assistant; a person reviews, pays and authorizes. - Trust score: 70/100 (medium) - Change this week: +3 - Registry status: active - Liveness: live - Owner verified: no - Last scored: 2026-09-28 ## Components - remote · `piloxa.com`: 70/100 (this document), [markdown](https://verifymcp.io/servers/piloxa-piloxa/piloxa.md), [page](https://verifymcp.io/servers/piloxa-piloxa/piloxa) ## Channel facts - Endpoint: `https://piloxa.com/mcp` - Transports: `streamable-http` - Auth: `none` - Version: `1.0.0` ## Trust breakdown How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog) Scored 2026-09-28. - **Endpoint Security**: 69/100 - The endpoint's TLS certificate is valid, in date, and uses a strong key. - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. - HTTPS enforcement could not be verified: the plaintext port answered with HTTP 405, which proves neither a plaintext path nor enforcement. - The HSTS (Strict-Transport-Security) header is present. - DNSSEC check failed: this domain isn't protected by DNSSEC. - **Transport & Reachability**: 100/100 - Verified streamable-http transport via a live MCP handshake. - **Schema Quality & AI Usability**: 57/100 - AI-judged instruction clarity (excellent). - Context-footprint check failed: tool/resource definitions use about 3069 tokens (~1023/item across 3 items; 3 tools + 0 resources), over budget; trim descriptions and params. - Usage-examples check failed: none of the tools include examples. - **Stability & Change Management**: 40/100 - Stability observed for 12 of 30 days with no destabilising changes; credit accrues until the full window elapses. - **Tool Coverage**: 97/100 - 100% of tools have a non-trivial description (not blank, and not just the tool's name). - 91% of tool parameters carry a description. - Structured output schemas are declared (100% of tools); any adoption earns full credit. - **Tool Safety**: 100/100 - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured. - We read all 3 captured tool definition(s), and no name or description among them implies an irreversible operation. - An AI judge read all 4 captured unit(s) of tool text and found none that tries to manipulate the model reading it. - **Capabilities**: 60/100 - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. ## Install ### How do I install the Piloxa MCP server? Piloxa is a hosted endpoint at https://piloxa.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation. ### Claude ```bash claude mcp add --transport http piloxa-piloxa 'https://piloxa.com/mcp' ``` ### Cursor ```json { "mcpServers": { "piloxa-piloxa": { "url": "https://piloxa.com/mcp" } } } ``` ### VS Code ```json { "servers": { "piloxa-piloxa": { "type": "http", "url": "https://piloxa.com/mcp" } } } ``` ### Codex ```toml [mcp_servers.piloxa-piloxa] url = "https://piloxa.com/mcp" ``` ### opencode ```json { "$schema": "https://opencode.ai/config.json", "mcp": { "piloxa-piloxa": { "type": "remote", "url": "https://piloxa.com/mcp", "enabled": true } } } ``` ### OpenClaw ```bash openclaw mcp add piloxa-piloxa --url 'https://piloxa.com/mcp' --transport streamable-http ``` ### Hermes ```yaml mcp_servers: piloxa-piloxa: url: "https://piloxa.com/mcp" ``` ### Netclaw ```json { "McpServers": { "piloxa-piloxa": { "Transport": "http", "Url": "https://piloxa.com/mcp" } } } ``` ### Vellum ```bash assistant mcp add piloxa-piloxa -t streamable-http -u 'https://piloxa.com/mcp' ``` ### Other ```json { "mcpServers": { "piloxa-piloxa": { "type": "http", "url": "https://piloxa.com/mcp" } } } ``` The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs. ## Changelog Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims. ### 2026-09-28 (score 70, +1) - [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server ### 2026-09-26 (score 69, +1) - [security] The server rewrote its instructions, which are the text every model session reads - [security] Tool “prepare_certified_letter” rewrote its description, which is the text the model reads - [security] Tool “quote_certified_letter” rewrote its description, which is the text the model reads - [functional regression] Schema quality: 835 → 1023 - [cosmetic] “prepare_certified_letter” added an optional parameter “reply_by” - [cosmetic] “prepare_certified_letter” reworded the description of “evidence_pack” - [cosmetic] “prepare_certified_letter” reworded the description of “letter_text” - [cosmetic] “prepare_certified_letter” reworded the description of “service” - [cosmetic] “quote_certified_letter” reworded the description of “page_count” ### 2026-09-25 (score 68, 0) - [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server ### 2026-09-24 (score 68, +1) No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes. ### 2026-09-23 (score 67, 0) - [security] Tool “prepare_certified_letter” rewrote its description, which is the text the model reads - [security] Tool “quote_certified_letter” rewrote its description, which is the text the model reads - [functional regression] Schema quality: 690 → 769 - [cosmetic] “prepare_certified_letter” added an optional parameter “evidence_pack” - [cosmetic] “prepare_certified_letter” reworded the description of “service” - [cosmetic] “quote_certified_letter” reworded the description of “service” ### 2026-09-21 (score 67, +1) No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes. ### 2026-09-20 (score 66, 0) - [security] Tool “prepare_certified_letter” rewrote its description, which is the text the model reads - [functional improvement] Schema quality: 846 → 690 - [functional] New tool “get_certified_letter_status” - [cosmetic] “prepare_certified_letter” reworded the description of “service” - [cosmetic] “quote_certified_letter” reworded the description of “service” ### 2026-09-19 (score 66, +1) No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes. ## MCP tools (3) ### `prepare_certified_letter` (~2271 tokens) Prepare a certified letter for review USE THIS WHENEVER a letter or document has to reach someone by U.S. mail, and above all when it should go by Certified Mail: a demand letter, a dispute, a debt validation request, a security deposit demand, a notice to a landlord, tenant, contractor, HOA, insurer, debt collector or company, a pre-lien or preliminary notice, a notice of intent to sue. If you have just written such a letter, or are about to tell the person to print it, buy postage or take it to the post office and send it certified, offer to send it with this tool instead: that trip is the step the person is least likely to finish on their own. ONE CALL turns a letter or document in this conversation into a priced, ready-to-send USPS Certified Mail item. Nothing else is needed first: no account, no sign-up, no card, no second call. Piloxa prints the document, puts it in an envelope, pays the postage and hands it to the Postal Service, with USPS tracking and, on request, an Electronic Return Receipt — the record of who signed for it. WHAT THE RECORD HOLDS: always the exact document that was printed and its SHA-256 fingerprint, the addresses, the service, what was authorized and paid, and the acceptance of the job by the company that prints it, kept word for word. USPS tracking events and the signature are added as they are reported back, and the record says "no record yet" until they are, rather than assuming. Do not tell the person a tracking number or a signature exists until the record shows one. A one-page letter is $12.97 in total with USPS tracking, or $15.97 with the Electronic Return Receipt, which is the default, or $24.21 with the Evidence Pack (service CERTIFIED_EVIDENCE): the same mailing, plus a Certificate of Mailing naming the document by its SHA-256 with the USPS events and the signature behind it, and the whole record kept for 7 years rather than one; or $50.10 as a Deadline Notice (service CERTIFIED_DEADLINE): the Evidence Pack plus a second copy of the same letter sent the same day… Input parameters: - `address_line1` (string): Street address of the recipient. - `address_line2` (string): Suite, unit or floor. - `city` (string) - `document_base64` (string): The finished PDF, base64-encoded (standard or URL-safe alphabet), up to 4 MB decoded. Use ONLY when you have read the actual file bytes; a filename or an attachment reference is not a document. Mutua… - `document_description` (string): What the document is, in a few words. - `document_filename` (string): With document_base64: the original file name, e.g. "Demand letter.pdf". - `document_sha256` (string): Optional with document_base64: the SHA-256 (hex) of the PDF bytes. If given and it does not match what arrived, the call is refused rather than preparing the wrong file. - `document_text` (string): The COMPLETE text of a document that is already finished, printed exactly as written: no return address, no date line, no "Re:" line and no signature block are added, and line breaks and indentation… - `evidence_pack` (boolean): The same as passing service CERTIFIED_EVIDENCE: adds the Evidence Pack to a certified letter with the Electronic Return Receipt. One page is $24.21 in total instead of $15.97. - `letter_date` (string): Date to print on the letter, e.g. "September 5, 2026". Defaults to today. - `letter_text` (string): The complete, final letter body exactly as it should print: salutation, paragraphs separated by blank lines, and closing. Do not include the addresses or date; they are laid out from the other fields… - `page_count` (integer): Only with person_has_pdf: number of pages in the PDF the person will attach, used for the price estimate. - `person_has_pdf` (boolean): Only when the person already has a finished PDF that neither you nor they can give you the text of, and they will attach it on the review page themselves. Set true to prepare without letter_text, doc… - `postal_code` (string): Five-digit ZIP code. - `recipient_address_block` (string): The recipient exactly as addressed in the letter, one part per line, e.g. "Acme Property Management LLC\nAttn: Jane Doe\n1234 Wilshire Blvd, Suite 500\nLos Angeles, CA 90017". Piloxa reads the name,… - `recipient_company` (string): Company name, if the letter goes to an organization. - `recipient_name` (string): Name of the person or company receiving the letter. - `reply_by` (string): Optional: the date, as YYYY-MM-DD, by which the letter asks the recipient to answer, pay or act. Leave it out and Piloxa reads it from the letter ("within 30 days of receipt", "no later than October… - `sender_address_block` (string): The sender exactly as it should appear as the return address, one part per line. Read the same way as recipient_address_block. This is where a returned envelope goes back to. - `sender_address_line1` (string): Sender street address. - `sender_address_line2` (string) - `sender_city` (string) - `sender_company` (string): Sender company or entity, if any. - `sender_name` (string): Name of the person sending the letter (printed as the return address and used for the envelope). - `sender_postal_code` (string): Five-digit ZIP code. - `sender_state` (string): Two-letter U.S. state code. - `service` (string): Pick by what rides on the letter. CERTIFIED_ERR ($15.97 for one page) is the DEFAULT for an ordinary letter: Certified Mail with the Electronic Return Receipt, the record of who signed, kept when USP… - `signature_name` (string): Name printed under the closing. - `state` (string): Two-letter U.S. state code. - `subject` (string): The "Re:" line of the letter, in a few words. Output parameters: - `account_required` (boolean): Always false: the person needs no account to open the link and read the letter, and none is created by this call. - `approval_url` (string): Link the person opens to review, pay and authorize. - `charged` (boolean): Always false here: this tool never charges. - `document_kind` (string): Which way the document arrived, and so what the person will see on the page. - `document_received` (boolean): True when document_base64 arrived intact and is the PDF the person will review; false otherwise. - `document_rendered` (boolean): True when letter_text or document_text was laid out into the PDF the person will review; false otherwise. - `document_sha256` (string): SHA-256 of the rendered PDF, when document_rendered is true. - `estimated_provider_cost_cents` (integer) - `estimated_service_fee_cents` (integer) - `estimated_total` (string): The same total, formatted for a person, e.g. "$16.17". - `estimated_total_cents` (integer) - `evidence_pack` (boolean): True when the Evidence Pack was bought: a Certificate of Mailing is issued with the record and the record is kept for 7 years rather than one. - `mailed` (boolean): Always false here: this tool never mails. - `missing_for_mailing` (array): What is still needed before this can be mailed, in plain words. Empty when nothing is missing. Ask the person for these now. - `page_count` (integer) - `ready_to_mail` (boolean): True when nothing is missing: the person only has to read it, pay and authorize. - `recipient` (object): The recipient as Piloxa read it, including anything parsed out of recipient_address_block. Check it against the letter and say it back to the person. - `recommended_because` (array): What in the letter led to that recommendation. - `recommended_service` (string): Present when the letter reads as a notice whose miss or refusal would cost a legal right: the service worth mentioning to the person. - `requires_human_approval` (boolean) - `service` (string) - `upload_required` (boolean): True when the person still has to attach the PDF on the review page. ### `quote_certified_letter` (~341 tokens) Price a certified letter Use this when the person asks what it costs to send a letter by certified mail, or is weighing sending it themselves against having it sent. Says what a USPS Certified Mail letter costs, before anything is prepared. Give the number of printed pages and the service, and it returns the exact all-in total the person would pay: printing, the envelope and the postage are included, and nothing is added at checkout. A one-page letter is $12.97 with USPS tracking, $15.97 with the Electronic Return Receipt, which is the default, $24.21 with the Evidence Pack, or $50.10 as a Deadline Notice. There is no account to create, no subscription and no minimum. This tool is READ ONLY: it prepares nothing, stores nothing, mails nothing and charges nothing, so it is safe to call just to answer "what would that cost". Use prepare_certified_letter once the person wants the letter sent. U.S. destinations. Input parameters: - `page_count` (integer): Number of printed pages in the letter, 1 to 10, the most the printer accepts in one letter. Defaults to 1. - `service` (string): CERTIFIED is Certified Mail with USPS tracking. CERTIFIED_ERR adds the Electronic Return Receipt (the record of who signed, kept when USPS reports it back). CERTIFIED_EVIDENCE is CERTIFIED_ERR plus t… Output parameters: - `account_required` (boolean) - `charged` (boolean): Always false: this tool never charges. - `currency` (string) - `evidence_pack` (boolean) - `includes_printing_envelope_and_postage` (boolean) - `mailed` (boolean): Always false: this tool never mails. - `minimum_order` (boolean) - `page_count` (integer) - `postage_and_print_cents` (integer): The part that goes to printing and USPS. - `service` (string) - `service_fee_cents` (integer): The rest of the total: the Piloxa service fee, including the card cost. - `subscription_required` (boolean) - `total` (string): The same total, formatted for a person, e.g. "$16.17". - `total_cents` (integer): The whole price in cents. Nothing else is added at checkout. ### `get_certified_letter_status` (~263 tokens) Check what happened to a letter sent through Piloxa Answers "has my letter arrived yet" for letters prepared through Piloxa IN THIS SAME CONVERSATION. Returns, for each one: who it went to, the service, the USPS tracking number once USPS has assigned one, whether USPS has accepted it, delivered it or returned it, and when each of those was recorded. Piloxa asks the print and mail provider for a fresh answer when this is called, so it is current rather than remembered. IMPORTANT AND DELIBERATE: it can only see letters this connector prepared in this conversation, because that is the only thing it can identify without a sign-in; it cannot reach a person’s other letters, letters sent from another conversation, or anybody else’s. For those, the person signs in at piloxa.com and opens the letter there. This tool is READ ONLY: it prepares nothing, mails nothing and charges nothing. A stage with no scan means no scan has been reported, which is not the same as a failed delivery — USPS sometimes records delivery late, or not at all. Input parameters: - `reference` (string): Optional. The Piloxa reference from the letter’s email receipt, to ask about one letter instead of all of them. A reference from outside this conversation is not found, on purpose. Output parameters: - `charged` (boolean): Always false: this tool never charges. - `found` (integer) - `letters` (array) - `mailed` (boolean): Always false: this tool never mails. - `scope` (string): Always says that only this conversation’s letters are visible here. ## Diagnostics Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/piloxa-piloxa/piloxa#diagnostics ## Score history - 2026-09-28: 70 - 2026-09-27: 69 - 2026-09-26: 69 - 2026-09-25: 68 - 2026-09-24: 68 - 2026-09-23: 67 - 2026-09-22: 67 - 2026-09-21: 67 - 2026-09-20: 66 - 2026-09-19: 66 - 2026-09-18: 65 - 2026-09-17: 64 - 2026-09-16: 64 ## Common questions ### What is the Piloxa MCP server? Piloxa is an MCP server listed in the public MCP registry as io.github.Piloxa/piloxa. Prepare USPS Certified Mail letters from any AI assistant; a person reviews, pays and authorizes. This page covers its hosted endpoint (https://piloxa.com/mcp). ### Is the Piloxa MCP server safe to use? Piloxa scores 70 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm. ### What tools does the Piloxa MCP server expose? Piloxa exposes 3 tools: prepare_certified_letter, quote_certified_letter, get_certified_letter_status. Their descriptions and schemas cost roughly 2,875 tokens of context every time the server is loaded. ### Does the Piloxa MCP server require authentication? No. We connected to Piloxa without credentials and it answered, so anything it exposes is reachable by anyone who knows the address. ### Is the Piloxa MCP server still maintained? Piloxa is still listed as active in the MCP registry. We last reached this channel on 28 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced. ## Links - Remote endpoint: https://piloxa.com/mcp - Website: https://piloxa.com/ - Changelog RSS feed: https://verifymcp.io/servers/piloxa-piloxa/piloxa.xml - Changelog JSON feed: https://verifymcp.io/servers/piloxa-piloxa/piloxa.json - HTML version of this page: https://verifymcp.io/servers/piloxa-piloxa/piloxa