Skyelight
REMOTE · APP.SKYELIGHT.AI · 2 COMPONENTS
Give your AI assistant feedback pinned to the exact element, with its code, so it can fix and reply.
Available components
Last scanned (18 hours ago)
Scores higher than 93% of remote servers
Reachable. Last reached 4 Nov 2026.
Category Project Management
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security97
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server supports Client ID Metadata Documents, the current MCP client-registration mechanism. View diagnostics → Pass
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability79
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 2905 tokens (~152/item across 19 items; 18 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management40
- Stability observed for 12 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage97
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 91% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 20 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.
- 31 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
- 29 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.
- 27 Oct 26 +1
- Tool “whats_new” rewrote its description, which is the text the model reads security
- 25 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 24 Oct 26 0
- Stability: unverified → 0.03 ▲ functional
- 23 Oct 26 81
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Probed https://app.skyelight.ai/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=app.skyelight.ai | CN=YR2,O=Let's Encrypt,C=US | 14 Sept 2026 | 13 Dec 2026 | RSA 2048 | SHA256-RSA | 6816d16155ec194c7f88ad281b1a15859ae |
| SANs: app.skyelight.ai | ||||||
| CN=YR2,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | 4ebd24947e24d394802d84a52fd5b319 |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of app.skyelight.ai. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| ai. | present | 1814, 3799 | 8, 8 | Verified |
| skyelight.ai. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer realm="skyelight", resource_metadata="https://app.skyelight.ai/.well-known/oauth-protected-resource/mcp"
Bearer realm="skyelight", resource_metadata="https://app.skyelight.ai/.well-known/oauth-protected-resource/mcp" | Header | Value |
|---|---|
| strict-transport-security | max-age=63072000 |
Protected resource metadata
| Document | https://app.skyelight.ai/.well-known/oauth-protected-resource/mcp |
|---|---|
| Retrieved | Yes |
| Resource | https://app.skyelight.ai/mcp |
| Authorisation server | https://clerk.skyelight.ai |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://app.skyelight.ai/mcp | Verified | 200 | |
| http (plaintext) | http://app.skyelight.ai/mcp | HTTPS enforced | 308 | https://app.skyelight.ai/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
assign Assign ~97
Hand an item to a person, who is notified the way an assignment in the app notifies them. Pass null as the assignee to unassign it. Only owners, admins and collaborators can assign; a resolved item has to be reopened first.
| Name | Type | Req | Description |
|---|---|---|---|
| assignee | string|null | yes | A name, email or id from list_members, "me", or null to unassign. |
| itemId | string | yes | Item id from list_items. |
No output schema declared.
No examples provided.
create_item Create feedback ~189
Open a new thread on a page, as the person whose connection you are using. Only available on a person's own connection — an agent reporting what it found or changed uses post_update on the thread it was working, so the answer lands where the question was asked.
| Name | Type | Req | Description |
|---|---|---|---|
| assignee | string | – | Who should take it: a name, email or id from list_members, or "me". |
| body | string | yes | What you want to say. |
| mentions | array | – | People to notify, by name, email or id from list_members ("me" is you). Write @Name in the body where you mention them. |
| pageTitle | string | – | – |
| projectId | string | – | Optional if a project is bound. |
| selector | string | – | CSS selector for the element, if there is one. |
| url | string | yes | Full URL of the page this is about. |
No output schema declared.
No examples provided.
decision_log Decision log ~149
The decisions a project made in its threads, quoted: every thread resolved or deferred after a discussion, with the conversation, plus types people corrected and where outcomes keep recurring. Also returns the project's existing rules, so you can tell what is new. Use it to write a decision log, or to find rules worth keeping with save_rule.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Decisions per page (default 15, at most 30). |
| offset | number | – | Where to start, from the previous result's 'more' line. |
| projectId | string | – | Optional if a project is bound. |
| since | string | – | Optional. Only decisions after this date ("2026-09-01"). |
No output schema declared.
No examples provided.
find_by_source Find feedback by source file ~166
Feedback by the code that rendered it, from the file and line the Skyelight build plugin stamps on each element. Pass a file (a path or just its name) or a component to see every thread about it before you edit it; pass neither to get the hot spots, every stamped file ranked by outstanding feedback.
| Name | Type | Req | Description |
|---|---|---|---|
| component | string | – | A component name, e.g. "PricingTable". |
| file | string | – | A source path or file name, e.g. "src/components/PricingTable.tsx" or "PricingTable.tsx". |
| limit | number | – | – |
| line | number | – | Optional. Threads nearest this line come first. |
| projectId | string | – | Optional if a project is bound. |
| status | string | – | – |
No output schema declared.
No examples provided.
find_similar Find similar feedback ~205
Has this already been reported? Pass the text you are about to report (and the page, if you know it) before create_item, or an itemId to find what an existing thread duplicates. Returns likely matches with why each matched: shared words, same page, same element, same source file. If two are the same problem, merge_items folds one into the other.
| Name | Type | Req | Description |
|---|---|---|---|
| includeResolved | boolean | – | Default true: a resolved match may mean it came back. false to skip them. |
| itemId | string | – | Instead of text: find duplicates of this item. |
| limit | number | – | Max matches (default 5). |
| page | string | – | Optional. A page path or URL, e.g. "/checkout". |
| projectId | string | – | Optional if a project is bound or itemId is given. |
| selector | string | – | Optional. CSS selector of the element. |
| text | string | – | What someone is about to report. |
No output schema declared.
No examples provided.
get_item Get feedback item ~84
Everything needed to work one item: the whole thread in order, the page and URL it is on, the anchor identifying the element the person pointed at, and the pictures — what the page looked like when it was pinned, plus anything people attached — returned as images you can look at rather than links you cannot.
| Name | Type | Req | Description |
|---|---|---|---|
| itemId | string | yes | Item id from list_items. |
No output schema declared.
No examples provided.
list_items List feedback ~287
List feedback items (bugs, ideas, comments) people left on a Skyelight project. Returns a summary of the project plus matching items. Start here to see what is outstanding. An item's hand-off (investigate, plan, fix) is set by the team and binding: on investigate or plan, reply on the thread and change no code.
| Name | Type | Req | Description |
|---|---|---|---|
| assignee | string | – | A user id, "me" for whoever this connection belongs to, or "none" for unassigned items. |
| limit | number | – | Max items (default 50). |
| page | string | – | Only items on one page, e.g. "/checkout". |
| projectId | string | – | Project to read. Optional when a project is bound or the workspace has only one; otherwise the error lists the projects and their ids. |
| status | string | – | Defaults to everything. "deferred" is work someone put off until later — outstanding, but deliberately not now. |
| task | string | – | Only items a person handed to an agent with this task (Hand off in the app), or "none" for items with no hand-off. Combine with assignee to find your own. Investigate and plan mean reply on the threa… |
| type | string | – | Item type, e.g. "bug", "idea", "feedback". |
No output schema declared.
No examples provided.
list_members List members ~90
The people in a workspace: name, email, role and id. Call it when you are asked to tell, ask or hand something to someone by name, then pass their name or id to assign, or in mentions on create_item or post_update.
| Name | Type | Req | Description |
|---|---|---|---|
| projectId | string | – | Optional if a project is bound. |
| workspaceId | string | – | Instead of a project, from list_workspaces. |
No output schema declared.
No examples provided.
list_projects List projects ~63
Projects you can reach, newest activity first, across every workspace unless one is named. Start here when no project is bound — `list_items` needs a project id and this is where one comes from.
| Name | Type | Req | Description |
|---|---|---|---|
| workspaceId | string | – | Narrow to one workspace. Optional. |
No output schema declared.
No examples provided.
list_workspaces List workspaces ~55
Workspaces you can reach, with the role you hold in each, and who you are. Use when you do not know what exists yet, to find which workspace a project belongs to, or to learn your own user id.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
merge_items Merge duplicates ~98
Fold duplicate items into one, the way merging works in the app: the duplicates leave the list and count as extra reports on the item they were merged into. Use it only when find_similar and the threads themselves show they are the same problem. Owners, admins and collaborators can merge.
| Name | Type | Req | Description |
|---|---|---|---|
| duplicateIds | array | yes | Items that report the same problem. |
| itemId | string | yes | The item to keep. The others fold into it. |
No output schema declared.
No examples provided.
post_update Post an update ~159
Report back on an item: what you found, what you changed, a link to the PR. Posts as a reply on the thread the feedback was left on, so the person who reported it sees the answer where they asked. Use this when you finish work on an item, and when you get stuck.
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | yes | What you found or changed, in plain language for the person who reported it. |
| itemId | string | yes | Item id from list_items. |
| links | array | – | Optional links — a PR, a commit, a deploy. |
| mentions | array | – | People to notify, by name, email or id from list_members ("me" is you). Write @Name in the body where you mention them. |
No output schema declared.
No examples provided.
project_review Review project ~170
Everything needed to write an accurate project review or hand-off document: the shape of the work, every resolved thread and how it ended, what was deferred and why, what is still open, and the longest conversations quoted in full, which is where decisions were made. Every entry carries its item id, so each claim in your document can be traced back to its thread. Quote; do not invent outcomes the threads do not state.
| Name | Type | Req | Description |
|---|---|---|---|
| offset | number | – | With section: where to start, from the previous result's 'more' line. |
| projectId | string | – | Project to review. Optional if a project is bound. |
| section | string | – | Omit for the overview (all counts, first rows of each section). Name one to read it in full, a page at a time. |
No output schema declared.
No examples provided.
publish_review_link Publish a review link ~450
Share something with Skyelight for review, and get a link people can pin feedback on. Two ways: - code: one file Skyelight hosts at its own link with the review badge on it. A whole HTML page, or one React component with an export default (Tailwind classes and npm imports work; local imports such as @/components do not). For Claude prototypes, v0 snippets and single pages. Publishing again with the same prototypeId, or the same name in the same project, makes a new version at the same link. - url: an app already deployed (a Lovable, v0, Bolt or Vercel project: anything with more than one file). Adds its address to the project's Review Links and returns a script tag to add to the app's <head> (index.html, or the root layout); add it and redeploy. Owners and admins. Returns the share link and the project link; give both to the person. A hosted link is public to anyone who has it.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | – | For Skyelight to host: the complete file, never a summary or an excerpt. Or give url. |
| kind | string | – | With code; worked out from it when left out. |
| name | string | – | What it is, in a few words. Names the hosted link and, when no project is given, a new project. |
| projectId | string | – | Optional: the project to put it in. Left out, a new project is made for it. |
| prototypeId | string | – | With code: to publish a new version of a prototype published before. |
| source | string | – | With code: where it was made, shown as its logo in Skyelight: "claude", "claude-code", "openai" (ChatGPT), "cursor", "windsurf", "v0", "lovable" or "other". Name yourself. |
| url | string | – | Where the app is deployed, e.g. https://my-app.lovable.app. Or give code. |
| workspaceId | string | – | When you are in more than one workspace and give no project, from list_workspaces. |
No output schema declared.
No examples provided.
save_rule Save a rule ~128
Keep a rule the team agreed on ("sentence case in every button", "the brand gray stays, do not raise contrast bugs on it") in the project's context, under Rules learned. The classifier reads that context, and every agent reads it through decision_log, so it shapes future threads. Cite the threads it came from. Workspace owners and admins only; confirm with the person before saving.
| Name | Type | Req | Description |
|---|---|---|---|
| projectId | string | – | Optional if a project is bound. |
| rule | string | yes | The rule, in one plain sentence. |
| sourceItemIds | array | – | Items the rule came from. |
No output schema declared.
No examples provided.
search_items Search feedback ~97
Find items whose thread mentions some text. Searches replies as well as the original message, so an item someone already diagnosed in a reply still turns up.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | – |
| projectId | string | – | Project to search. Optional when a project is bound or the workspace has only one; otherwise the error lists the projects and their ids. |
| query | string | yes | Text to look for. |
| status | string | – | – |
No output schema declared.
No examples provided.
set_status Set status ~85
Move an item to open, deferred or resolved. Use it to close the loop after you have fixed something and said so — post_update first, so the person who reported it reads what changed, then set_status. "deferred" is for work that is real but not now.
| Name | Type | Req | Description |
|---|---|---|---|
| itemId | string | yes | Item id from list_items. |
| status | string | yes | – |
No output schema declared.
No examples provided.
whats_new What's new ~133
What changed on a project since you last looked: new threads, new replies grouped by thread, what was resolved or deferred, and what was assigned to you or mentioned you. Use when the user asks what has changed on a project since they last checked. Without `since` it reads from their bookmark and moves it forward; with `since` it reads that window and leaves the bookmark alone.
| Name | Type | Req | Description |
|---|---|---|---|
| projectId | string | – | Optional if a project is bound. |
| since | string | – | Optional. A date or time ("2026-09-01", an ISO time) to read from instead of your bookmark. |
No output schema declared.
No examples provided.
How do I install the Skyelight MCP server?
Skyelight is a hosted endpoint at https://app.skyelight.ai/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · app.skyelight.ai
claude mcp add --transport http plastrlab-skyelight-mcp 'https://app.skyelight.ai/mcp'
What is the Skyelight MCP server?
Skyelight is an MCP server listed in the public MCP registry as io.github.plastrlab/skyelight-mcp. Give your AI assistant feedback pinned to the exact element, with its code, so it can fix and reply. This page covers its hosted endpoint (https://app.skyelight.ai/mcp).
Is the Skyelight MCP server safe to use?
Skyelight scores 86 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Skyelight MCP server expose?
Skyelight exposes 18 tools: list_workspaces, list_projects, list_items, search_items, post_update, and 13 more. Their descriptions and schemas cost roughly 2,705 tokens of context every time the server is loaded.
Does the Skyelight MCP server require authentication?
Yes. Skyelight asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the Skyelight MCP server still maintained?
Skyelight is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.