AgentDeals
REMOTE · AGENTDEALS.DEV · SCANNED SEP 24
MCP server aggregating developer infrastructure deals, free tiers, and startup programs
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security74
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability84
- 98% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Partial
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 24405 tokens (~14/item across 1720 items; 5 tools + 1715 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management41
- Stability check failed: schema churn in the 30 days we've observed: 7 tool removals, 0 breaking changes, 0 auth/transport breaks, 0 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 5 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 7 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
- Supports UI / widget rendering.Pass
How do I install the AgentDeals MCP server?
AgentDeals is a hosted endpoint at https://agentdeals.dev/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · agentdeals.dev
claude mcp add --transport http robhunter-agentdeals 'https://agentdeals.dev/mcp'
{
"mcpServers": {
"robhunter-agentdeals": {
"url": "https://agentdeals.dev/mcp"
}
}
} {
"servers": {
"robhunter-agentdeals": {
"type": "http",
"url": "https://agentdeals.dev/mcp"
}
}
} [mcp_servers.robhunter-agentdeals] url = "https://agentdeals.dev/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"robhunter-agentdeals": {
"type": "remote",
"url": "https://agentdeals.dev/mcp",
"enabled": true
}
}
} openclaw mcp add robhunter-agentdeals --url 'https://agentdeals.dev/mcp' --transport streamable-http
mcp_servers:
robhunter-agentdeals:
url: "https://agentdeals.dev/mcp" {
"McpServers": {
"robhunter-agentdeals": {
"Transport": "http",
"Url": "https://agentdeals.dev/mcp"
}
}
} assistant mcp add robhunter-agentdeals -t streamable-http -u 'https://agentdeals.dev/mcp'
{
"mcpServers": {
"robhunter-agentdeals": {
"type": "http",
"url": "https://agentdeals.dev/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 23 Sept 26 0
- The server rewrote its instructions, which are the text every model session reads security
- 22 Sept 26 0
- The server rewrote its instructions, which are the text every model session reads security
- 21 Sept 26 0
- The server rewrote its instructions, which are the text every model session reads security
- New resource “StackHawk” functional
- 20 Sept 26 0
- The server rewrote its instructions, which are the text every model session reads security
- New resource “Coder” functional
- New resource “ElevenLabs” functional
- New resource “Jenkins” functional
- New resource “Ona” functional
- New resource “PlanetScale” functional
- New resource “Stability AI” functional
- 19 Sept 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “search_deals” rewrote its description, which is the text the model reads security
- “search_deals” reworded the description of “since” cosmetic
- “search_deals” reworded the description of “sort” cosmetic
- 17 Sept 26 0
- “track_changes” reworded the description of “categories” cosmetic
- “track_changes” reworded the description of “vendor” cosmetic
- “track_changes” reworded the description of “vendors” cosmetic
3 cosmetic changes on this day. Switch on “Show cosmetic changes” to see them.
- 16 Sept 26 0
- “track_changes” added an optional parameter “include_index_housekeeping” cosmetic
- “track_changes” added an optional parameter “include_retracted” cosmetic
- “track_changes” reworded the description of “since” cosmetic
3 cosmetic changes on this day. Switch on “Show cosmetic changes” to see them.
- 12 Sept 26 +6
- Judged manipulation: unverified → pass ▲ security
- Schema quality: unverified → good ▲ functional
- “search_deals” reworded the description of “stability” cosmetic
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 24 Sept 2026 · Probed https://agentdeals.dev/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=agentdeals.dev | CN=YE2,O=Let's Encrypt,C=US | 10 Sept 2026 | 9 Dec 2026 | ECDSA 256 | ECDSA-SHA384 | 55e38d2c893dc2d7bc49b0613ebeec6f8b5 |
| SANs: *.agentdeals.dev, agentdeals.dev | ||||||
| CN=YE2,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 4df3b15dd6c0784c507cd37b58e6f115 |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of agentdeals.dev. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| dev. | present | 60074 | 8 | Verified |
| agentdeals.dev. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://agentdeals.dev/mcp | Verified | 200 | |
| http (plaintext) | http://agentdeals.dev/mcp | HTTPS enforced | 301 | https://agentdeals.dev/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
compare_vendors ~128
Compare developer tools and services side by side — free tier limits, pricing tiers, and recent pricing changes. Use this when choosing between similar services (e.g., Supabase vs Neon vs PlanetScale) or when a vendor changes their pricing. Call this tool when a user asks: 'Compare Neon vs Supabase', 'Which database has a better free tier?'.
| Name | Type | Req | Description |
|---|---|---|---|
| include_risk | boolean | – | Include risk assessment (default: true) |
| vendors | array | yes | 1 or 2 vendor names. 1 vendor = risk check. 2 vendors = side-by-side comparison. |
No output schema declared.
No examples provided.
get_referral_code ~77
Look up the referral link we hold for a vendor, with the reader benefit and every restriction attached to it. We hold codes for a handful of vendors and earn a commission on them; /disclosure lists all of them.
| Name | Type | Req | Description |
|---|---|---|---|
| vendor | string | yes | Vendor name to get the referral code for (e.g. 'Railway') |
No output schema declared.
No examples provided.
plan_stack ~359
Plan a technology stack with cost-optimized infrastructure choices. In recommend mode this returns, for each role, the set of offers whose terms we can stand behind today — deliberately not a single pick, because under every signal we record dozens of them tie. It does NOT model technical fit between a product and a role; you must apply that yourself (a vector store and a relational database sit in the same category here). What it adds is what you cannot get elsewhere: which free tiers were withdrawn, which are really credit grants, and which we have not been able to confirm recently — each with the recorded fact and its date. Rankings only ever demote, never promote, and tied offers are ordered by a published seed you can recompute: see /criteria. Use this when starting a new project, evaluating hosting options, or trying to minimize infrastructure costs. Call this tool when a user asks: 'What free tools can I use for a SaaS app?', 'Build me a stack under $50/month'.
| Name | Type | Req | Description |
|---|---|---|---|
| mode | string | yes | recommend: free-tier stack for a use case. estimate: cost analysis at scale. audit: risk + cost + gap analysis. |
| requirements | array | – | Specific infra needs for recommend mode (e.g. ['database', 'auth', 'email']) |
| scale | string | – | Scale for cost estimation (default: hobby) |
| services | array | – | Current vendor names (for estimate/audit mode, e.g. ['Vercel', 'Supabase']). An audit analyses only names it matched exactly; anything else comes back as status not_found with suggestions rather than… |
| use_case | string | – | What you're building (for recommend mode, e.g. 'Next.js SaaS app') |
No output schema declared.
No examples provided.
search_deals ~435
Find free tiers, startup credits, and developer deals for cloud infrastructure, databases, hosting, CI/CD, monitoring, auth, AI services, and more. Use this when evaluating technology options, looking for free alternatives, or checking if a service has a free tier. Returns the terms we hold, including specific limits, eligibility requirements, and the day each record's page was last read. Call this tool when a user asks: 'Does Supabase have a free tier?', 'What's cheaper than Vercel?', 'Find me a free database'.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Filter by category. Pass "list" to get all categories with counts. |
| eligibility | string | – | Filter by eligibility type |
| limit | number | – | Max results (default: 20) |
| offset | number | – | Pagination offset (default: 0) |
| payment_protocol | string | – | Filter by agent payment protocol. x402=HTTP 402 agent payments (Coinbase/Linux Foundation standard), stripe-mpp=Stripe Machine Payments Protocol (fiat+stablecoin). |
| query | string | – | Keyword search (vendor names, descriptions, tags) |
| response_format | string | – | Response detail level. 'concise': vendor name, tier, one-line description, URL only. 'detailed': full response (default). |
| since | string | – | ISO date (YYYY-MM-DD). Only return deals whose catalogue date is on or after this date. |
| sort | string | – | Sort: vendor (A-Z), category, newest (newest catalogue date first) |
| stability | string | – | Filter by the stability class we publish for the offer. stable=no negative changes on a pricing page we could read, watch=one negative change, volatile=free tier removed or multiple negative changes,… |
| vendor | string | – | Get full details for a specific vendor (fuzzy match). Returns alternatives in the same category. |
No output schema declared.
No examples provided.
track_changes ~670
Track recent pricing changes across developer tools — which free tiers were removed, which got limits cut, and which improved. Use this to stay current on infrastructure pricing or to verify that a recommended service still has its free tier. Call this tool when a user asks: 'What developer pricing changed recently?', 'Are any free tiers being removed?'.
| Name | Type | Req | Description |
|---|---|---|---|
| categories | string | – | Comma-separated category names to filter (e.g. 'Database,Cloud Hosting'). Matched by case-insensitive substring, not by exact name: vendor=Pilot returns GitHub Copilot's records and category=ai retur… |
| change_type | string | – | Filter by type of change |
| include_expiring | boolean | – | Include upcoming expirations (default: true) |
| include_index_housekeeping | boolean | – | Records of our own index housekeeping (reports 'our_index') are left out unless you ask for them. They say we stopped listing an offer of ours, not that the vendor changed anything, so counting them… |
| include_retracted | boolean | – | Records we have withdrawn as our own error (standing 'retracted') are left out unless you ask for them. Set true to receive them alongside the rest; they arrive carrying standing 'retracted' and impa… |
| lookahead_days | number | – | Days to look ahead for expirations (default: 30) |
| response_format | string | – | Response detail level. 'concise': vendor, change_type, date, summary only. 'detailed': full response (default). |
| since | string | – | ISO date (YYYY-MM-DD). Default: 30 days ago, and only when no other filter is passed — a request carrying type, vendor, vendors, categories or category searches the whole change log unless since says… |
| vendor | string | – | Filter to one vendor. Matched by case-insensitive substring, not by exact name: vendor=Pilot returns GitHub Copilot's records and category=ai returns Email's. Nothing is narrowed on your behalf, so r… |
| vendors | string | – | Comma-separated vendor names to filter (e.g. 'Vercel,Supabase'). When provided with categories, returns personalized results with advisory section. Matched by case-insensitive substring, not by exact… |
No output schema declared.
No examples provided.
What is the AgentDeals MCP server?
AgentDeals is an MCP server listed in the public MCP registry as io.github.robhunter/agentdeals. MCP server aggregating developer infrastructure deals, free tiers, and startup programs. This page covers its hosted endpoint (https://agentdeals.dev/mcp).
Is the AgentDeals MCP server safe to use?
AgentDeals scores 78 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the AgentDeals MCP server expose?
AgentDeals exposes 5 tools: search_deals, plan_stack, compare_vendors, track_changes, get_referral_code. Their descriptions and schemas cost roughly 1,669 tokens of context every time the server is loaded.
Does the AgentDeals MCP server require authentication?
No. We connected to AgentDeals without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the AgentDeals MCP server still maintained?
AgentDeals is still listed as active in the MCP registry. We last reached this channel on 24 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.