Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Skyelight

REMOTE · APP.SKYELIGHT.AI · 2 COMPONENTS

Give your AI assistant feedback pinned to the exact element, with its code, so it can fix and reply.

+3 this week 86 Trust /100

Last scanned (18 hours ago)

Scores higher than 93% of remote servers

Reachable. Last reached 4 Nov 2026.

Category Project Management

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security97
Transport & Reachability100
Schema Quality & AI Usability79
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 2905 tokens (~152/item across 19 items; 18 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management40
  • Stability observed for 12 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage97
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 91% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 20 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

  • 31 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

  • 29 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

  • 27 Oct 26 +1
    • Tool “whats_new” rewrote its description, which is the text the model reads security
  • 25 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

  • 24 Oct 26 0
    • Stability: unverified → 0.03 ▲ functional
  • 23 Oct 26 81

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Nov 2026 · Probed https://app.skyelight.ai/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=app.skyelight.ai CN=YR2,O=Let's Encrypt,C=US 14 Sept 2026 13 Dec 2026 RSA 2048 SHA256-RSA 6816d16155ec194c7f88ad281b1a15859ae
SANs: app.skyelight.ai
CN=YR2,O=Let's Encrypt,C=US (CA) CN=Root YR,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 RSA 2048 SHA256-RSA 4ebd24947e24d394802d84a52fd5b319
CN=Root YR,O=ISRG,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 RSA 4096 SHA256-RSA f24b6d17f9d9ad7cb1c9fea78782699f

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of app.skyelight.ai. — Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
ai. present 1814, 3799 8, 8 Verified
skyelight.ai. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication Enforced and verified

The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.

Result Enforced and verified
Enforced On tool calls
HTTP status 200

WWW-Authenticate challenge Bearer realm="skyelight", resource_metadata="https://app.skyelight.ai/.well-known/oauth-protected-resource/mcp"

Bearer realm="skyelight", resource_metadata="https://app.skyelight.ai/.well-known/oauth-protected-resource/mcp"
Header Value
strict-transport-security max-age=63072000

Protected resource metadata

Document https://app.skyelight.ai/.well-known/oauth-protected-resource/mcp
Retrieved Yes
Resource https://app.skyelight.ai/mcp
Authorisation server https://clerk.skyelight.ai

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://app.skyelight.ai/mcp Verified 200
http (plaintext) http://app.skyelight.ai/mcp HTTPS enforced 308 https://app.skyelight.ai/mcp
MCP tools · 18 exposed · ~2,705 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
assign ~97

Hand an item to a person, who is notified the way an assignment in the app notifies them. Pass null as the assignee to unassign it. Only owners, admins and collaborators can assign; a resolved item has to be reopened first.

NameTypeReqDescription
assigneestring|nullyesA name, email or id from list_members, "me", or null to unassign.
itemIdstringyesItem id from list_items.

No output schema declared.

No examples provided.

create_item ~189

Open a new thread on a page, as the person whose connection you are using. Only available on a person's own connection — an agent reporting what it found or changed uses post_update on the thread it was working, so the answer lands where the question was asked.

NameTypeReqDescription
assigneestring–Who should take it: a name, email or id from list_members, or "me".
bodystringyesWhat you want to say.
mentionsarray–People to notify, by name, email or id from list_members ("me" is you). Write @Name in the body where you mention them.
pageTitlestring––
projectIdstring–Optional if a project is bound.
selectorstring–CSS selector for the element, if there is one.
urlstringyesFull URL of the page this is about.

No output schema declared.

No examples provided.

decision_log ~149

The decisions a project made in its threads, quoted: every thread resolved or deferred after a discussion, with the conversation, plus types people corrected and where outcomes keep recurring. Also returns the project's existing rules, so you can tell what is new. Use it to write a decision log, or to find rules worth keeping with save_rule.

NameTypeReqDescription
limitnumber–Decisions per page (default 15, at most 30).
offsetnumber–Where to start, from the previous result's 'more' line.
projectIdstring–Optional if a project is bound.
sincestring–Optional. Only decisions after this date ("2026-09-01").

No output schema declared.

No examples provided.

find_by_source ~166

Feedback by the code that rendered it, from the file and line the Skyelight build plugin stamps on each element. Pass a file (a path or just its name) or a component to see every thread about it before you edit it; pass neither to get the hot spots, every stamped file ranked by outstanding feedback.

NameTypeReqDescription
componentstring–A component name, e.g. "PricingTable".
filestring–A source path or file name, e.g. "src/components/PricingTable.tsx" or "PricingTable.tsx".
limitnumber––
linenumber–Optional. Threads nearest this line come first.
projectIdstring–Optional if a project is bound.
statusstring––

No output schema declared.

No examples provided.

find_similar ~205

Has this already been reported? Pass the text you are about to report (and the page, if you know it) before create_item, or an itemId to find what an existing thread duplicates. Returns likely matches with why each matched: shared words, same page, same element, same source file. If two are the same problem, merge_items folds one into the other.

NameTypeReqDescription
includeResolvedboolean–Default true: a resolved match may mean it came back. false to skip them.
itemIdstring–Instead of text: find duplicates of this item.
limitnumber–Max matches (default 5).
pagestring–Optional. A page path or URL, e.g. "/checkout".
projectIdstring–Optional if a project is bound or itemId is given.
selectorstring–Optional. CSS selector of the element.
textstring–What someone is about to report.

No output schema declared.

No examples provided.

get_item ~84

Everything needed to work one item: the whole thread in order, the page and URL it is on, the anchor identifying the element the person pointed at, and the pictures — what the page looked like when it was pinned, plus anything people attached — returned as images you can look at rather than links you cannot.

NameTypeReqDescription
itemIdstringyesItem id from list_items.

No output schema declared.

No examples provided.

list_items ~287

List feedback items (bugs, ideas, comments) people left on a Skyelight project. Returns a summary of the project plus matching items. Start here to see what is outstanding. An item's hand-off (investigate, plan, fix) is set by the team and binding: on investigate or plan, reply on the thread and change no code.

NameTypeReqDescription
assigneestring–A user id, "me" for whoever this connection belongs to, or "none" for unassigned items.
limitnumber–Max items (default 50).
pagestring–Only items on one page, e.g. "/checkout".
projectIdstring–Project to read. Optional when a project is bound or the workspace has only one; otherwise the error lists the projects and their ids.
statusstring–Defaults to everything. "deferred" is work someone put off until later — outstanding, but deliberately not now.
taskstring–Only items a person handed to an agent with this task (Hand off in the app), or "none" for items with no hand-off. Combine with assignee to find your own. Investigate and plan mean reply on the threa…
typestring–Item type, e.g. "bug", "idea", "feedback".

No output schema declared.

No examples provided.

list_members ~90

The people in a workspace: name, email, role and id. Call it when you are asked to tell, ask or hand something to someone by name, then pass their name or id to assign, or in mentions on create_item or post_update.

NameTypeReqDescription
projectIdstring–Optional if a project is bound.
workspaceIdstring–Instead of a project, from list_workspaces.

No output schema declared.

No examples provided.

list_projects ~63

Projects you can reach, newest activity first, across every workspace unless one is named. Start here when no project is bound — `list_items` needs a project id and this is where one comes from.

NameTypeReqDescription
workspaceIdstring–Narrow to one workspace. Optional.

No output schema declared.

No examples provided.

list_workspaces ~55

Workspaces you can reach, with the role you hold in each, and who you are. Use when you do not know what exists yet, to find which workspace a project belongs to, or to learn your own user id.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

merge_items ~98

Fold duplicate items into one, the way merging works in the app: the duplicates leave the list and count as extra reports on the item they were merged into. Use it only when find_similar and the threads themselves show they are the same problem. Owners, admins and collaborators can merge.

NameTypeReqDescription
duplicateIdsarrayyesItems that report the same problem.
itemIdstringyesThe item to keep. The others fold into it.

No output schema declared.

No examples provided.

post_update ~159

Report back on an item: what you found, what you changed, a link to the PR. Posts as a reply on the thread the feedback was left on, so the person who reported it sees the answer where they asked. Use this when you finish work on an item, and when you get stuck.

NameTypeReqDescription
bodystringyesWhat you found or changed, in plain language for the person who reported it.
itemIdstringyesItem id from list_items.
linksarray–Optional links — a PR, a commit, a deploy.
mentionsarray–People to notify, by name, email or id from list_members ("me" is you). Write @Name in the body where you mention them.

No output schema declared.

No examples provided.

project_review ~170

Everything needed to write an accurate project review or hand-off document: the shape of the work, every resolved thread and how it ended, what was deferred and why, what is still open, and the longest conversations quoted in full, which is where decisions were made. Every entry carries its item id, so each claim in your document can be traced back to its thread. Quote; do not invent outcomes the threads do not state.

NameTypeReqDescription
offsetnumber–With section: where to start, from the previous result's 'more' line.
projectIdstring–Project to review. Optional if a project is bound.
sectionstring–Omit for the overview (all counts, first rows of each section). Name one to read it in full, a page at a time.

No output schema declared.

No examples provided.

publish_review_link ~450

Share something with Skyelight for review, and get a link people can pin feedback on. Two ways: - code: one file Skyelight hosts at its own link with the review badge on it. A whole HTML page, or one React component with an export default (Tailwind classes and npm imports work; local imports such as @/components do not). For Claude prototypes, v0 snippets and single pages. Publishing again with the same prototypeId, or the same name in the same project, makes a new version at the same link. - url: an app already deployed (a Lovable, v0, Bolt or Vercel project: anything with more than one file). Adds its address to the project's Review Links and returns a script tag to add to the app's <head> (index.html, or the root layout); add it and redeploy. Owners and admins. Returns the share link and the project link; give both to the person. A hosted link is public to anyone who has it.

NameTypeReqDescription
codestring–For Skyelight to host: the complete file, never a summary or an excerpt. Or give url.
kindstring–With code; worked out from it when left out.
namestring–What it is, in a few words. Names the hosted link and, when no project is given, a new project.
projectIdstring–Optional: the project to put it in. Left out, a new project is made for it.
prototypeIdstring–With code: to publish a new version of a prototype published before.
sourcestring–With code: where it was made, shown as its logo in Skyelight: "claude", "claude-code", "openai" (ChatGPT), "cursor", "windsurf", "v0", "lovable" or "other". Name yourself.
urlstring–Where the app is deployed, e.g. https://my-app.lovable.app. Or give code.
workspaceIdstring–When you are in more than one workspace and give no project, from list_workspaces.

No output schema declared.

No examples provided.

save_rule ~128

Keep a rule the team agreed on ("sentence case in every button", "the brand gray stays, do not raise contrast bugs on it") in the project's context, under Rules learned. The classifier reads that context, and every agent reads it through decision_log, so it shapes future threads. Cite the threads it came from. Workspace owners and admins only; confirm with the person before saving.

NameTypeReqDescription
projectIdstring–Optional if a project is bound.
rulestringyesThe rule, in one plain sentence.
sourceItemIdsarray–Items the rule came from.

No output schema declared.

No examples provided.

search_items ~97

Find items whose thread mentions some text. Searches replies as well as the original message, so an item someone already diagnosed in a reply still turns up.

NameTypeReqDescription
limitnumber––
projectIdstring–Project to search. Optional when a project is bound or the workspace has only one; otherwise the error lists the projects and their ids.
querystringyesText to look for.
statusstring––

No output schema declared.

No examples provided.

set_status ~85

Move an item to open, deferred or resolved. Use it to close the loop after you have fixed something and said so — post_update first, so the person who reported it reads what changed, then set_status. "deferred" is for work that is real but not now.

NameTypeReqDescription
itemIdstringyesItem id from list_items.
statusstringyes–

No output schema declared.

No examples provided.

whats_new ~133

What changed on a project since you last looked: new threads, new replies grouped by thread, what was resolved or deferred, and what was assigned to you or mentioned you. Use when the user asks what has changed on a project since they last checked. Without `since` it reads from their bookmark and moves it forward; with `since` it reads that window and leaves the bookmark alone.

NameTypeReqDescription
projectIdstring–Optional if a project is bound.
sincestring–Optional. A date or time ("2026-09-01", an ISO time) to read from instead of your bookmark.

No output schema declared.

No examples provided.

Install

How do I install the Skyelight MCP server?

Skyelight is a hosted endpoint at https://app.skyelight.ai/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · app.skyelight.ai

# add to Claude Code
claude mcp add --transport http plastrlab-skyelight-mcp 'https://app.skyelight.ai/mcp'
Common questions

What is the Skyelight MCP server?

Skyelight is an MCP server listed in the public MCP registry as io.github.plastrlab/skyelight-mcp. Give your AI assistant feedback pinned to the exact element, with its code, so it can fix and reply. This page covers its hosted endpoint (https://app.skyelight.ai/mcp).

Is the Skyelight MCP server safe to use?

Skyelight scores 86 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Skyelight MCP server expose?

Skyelight exposes 18 tools: list_workspaces, list_projects, list_items, search_items, post_update, and 13 more. Their descriptions and schemas cost roughly 2,705 tokens of context every time the server is loaded.

Does the Skyelight MCP server require authentication?

Yes. Skyelight asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

Is the Skyelight MCP server still maintained?

Skyelight is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.