Spoofy
REMOTE · SPOOFY.SOCIAL
Quote and order followers, views, likes and members for any public link, with spend caps.
Available components
Last scanned (20 hours ago)
Scores higher than 93% of remote servers
Reachable. Last reached 4 Nov 2026.
Category Marketing and SEO
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security97
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server supports Client ID Metadata Documents, the current MCP client-registration mechanism. View diagnostics → Pass
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability63
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 4186 tokens (~246/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management53
- Stability observed for 16 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 17 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
- 31 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.
- 29 Oct 26 +1
- Tool “create_automation” rewrote its description, which is the text the model reads security
- Tool “update_automation” rewrote its description, which is the text the model reads security
- 28 Oct 26 0
- The server rewrote its instructions, which are the text every model session reads security
- New tool “update_automation”, which the server declares destructive security
- Tool “create_automation” rewrote its description, which is the text the model reads security
- Schema quality: 3629 → 4147 ▼ functional
- 27 Oct 26 0
- The server rewrote its instructions, which are the text every model session reads security
- New tool “add_automation_link”, which the server declares destructive security
- Tool “create_automation” rewrote its description, which is the text the model reads security
- Schema quality: 3192 → 3629 ▼ functional
- 26 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.
- 24 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Probed https://spoofy.social/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=spoofy.social | CN=YE1,O=Let's Encrypt,C=US | 17 Oct 2026 | 15 Jan 2027 | ECDSA 256 | ECDSA-SHA384 | 6bfda61708185f791d5cf983a11bc5ee5e2 |
| SANs: *.spoofy.social, spoofy.social | ||||||
| CN=YE1,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 5ddd70dd31f801c85c186a7a04b80afe |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of spoofy.social. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| social. | present | 40816 | 8 | Verified |
| spoofy.social. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer realm="Spoofy", resource_metadata="https://spoofy.social/.well-known/oauth-protected-resource/mcp", scope="spoofy:read"
Bearer realm="Spoofy", resource_metadata="https://spoofy.social/.well-known/oauth-protected-resource/mcp", scope="spoofy:read" | Header | Value |
|---|---|
| strict-transport-security | max-age=15552000 |
| x-content-type-options | nosniff |
Protected resource metadata
| Document | https://spoofy.social/.well-known/oauth-protected-resource/mcp |
|---|---|
| Retrieved | Yes |
| Resource | https://spoofy.social/mcp |
| Authorisation server | https://spoofy.social |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://spoofy.social/mcp | Verified | 200 | |
| http (plaintext) | http://spoofy.social/mcp | HTTPS enforced | 301 | https://spoofy.social/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_automation_link Send a post to a plan (spends one run) ~237
For an automation of kind per_link ("a new post each run"): the link of its next run — the new post, video or track the user wants it on. The run goes out at once as an ordinary order at the price the plan was set up with, charged from the balance (one run of the plan the user already agreed to; nothing else is charged). The link must be one the plan takes (its platform and kind: a post plan takes posts, never a profile or a token page), and each link takes one run only. Errors: not_per_link, wrong_platform / wrong_link_kind (the message says what the plan takes), link_already_used, no_runs_left, automation_ended, automation_paused. A short balance keeps the run waiting and pauses the plan until a top-up covers it; it then goes by itself.
| Name | Type | Req | Description |
|---|---|---|---|
| automation | integer | yes | The automation number (the `id` of an automation, e.g. 2001). |
| link | string | yes | The new post's full link, e.g. https://coinmarketcap.com/community/post/123456789. |
No output schema declared.
No examples provided.
cancel_automation Cancel an automation ~94
Stop an automation for good: every future run is cancelled. Orders already running finish, unless cancel_running: true asks those that allow it to cancel too (the undelivered part is refunded). Confirm with the user first.
| Name | Type | Req | Description |
|---|---|---|---|
| automation | integer | yes | The automation number (the `id` of an automation, e.g. 2001). |
| cancel_running | boolean | – | Also ask its running orders to cancel. |
No output schema declared.
No examples provided.
cancel_order Cancel an order ~71
Ask to cancel a pending or processing order (only when the order says cancelable: true). Whatever was not delivered is refunded to the balance in USD. Confirm with the user first.
| Name | Type | Req | Description |
|---|---|---|---|
| order | integer | yes | The order number (the `id` field of an order, e.g. 1042). |
No output schema declared.
No examples provided.
create_automation Set up an automation (spends balance as it runs) ~742
Set up an automation: Spoofy places ordinary orders for the user on a plan. Kinds: spread (a total over time, e.g. {"kind":"spread","service":12,"link":"…","quantity":10000,"over":"3d"}; pace "steady" or "front" for an S-curve growth plan, "launch" for about half straight away then each run smaller), scheduled (one order at start_at), recurring (every "1d"/"6h"/"1w", optional at "14:00" + timezone, with times, until or budget), split (past one order's max), campaign (steps [{service, link, quantity, offset_minutes, over_minutes}] or template: "token-launch" + links), keep_above (target + days + budget; public Telegram channels/groups and YouTube videos only), feed (a public Telegram channel, YouTube channel, CoinMarketCap Community profile, Pinterest profile or board, Bluesky account, Reddit user or subreddit, RSS feed, or an X account while X's API is on: every new post gets quantity of service — or quantity_min + quantity_max, a random whole number in that range for each post; spread_minutes (30–360) + parts (2–10) splits each post's order into parts at random times within the window, each at least the service's minimum (pace "launch": the first part about half); delay_min_minutes + delay_max_minutes start it a random number of minutes after the post; posts: the next N posts, then it completes — "likes on my next 30 posts" is posts 30, no days needed; max_per_day; budget, needed only without posts; change them later with update_automation), per_link (a new post each run: service, quantity each run, runs, optional every "daily" + at "14:00" and days; no link now — each run goes out when its post's link is sent with add_automation_link; runs not used are never charged). For new posts elsewhere (Instagram, TikTok …) order an "On new posts" service instead (find_services; fields username, min, max, posts, delay): the provider watches the account. Service ids come from find_services. THIS SPENDS THE USER'S REAL BALANCE: each run is charged when it goes (never above th…
| Name | Type | Req | Description |
|---|---|---|---|
| automation | object | yes | The automation, exactly as POST /api/v1/automations takes it: {"kind": …, "service": …, "link": …, …}. |
| confirm | boolean | – | Must be true to actually create it. Only after the user agreed to the plan and its cost. |
| dry_run | boolean | – | true = plan and price only, create nothing. |
| idempotency_key | string | – | Unique string per intended automation; a retry with the same key returns the first one. |
No output schema declared.
No examples provided.
find_services Find services ~418
Find what Spoofy can do for a link or a goal, with prices. ALWAYS call this first: service ids come from here. Give `link` (any profile, post, video, channel, group, token page or website URL) and/or `goal` in plain words, e.g. "500 followers on my tiktok" or "cheap views for this YouTube video". With a link you only get services that fit that exact link (a profile link gets followers, a post link gets likes/views). Returns matching services: `service` (the id to quote/order), name, tier (basic/standard/premium), pricePer1k (USD per 1,000 units), min/max quantity, start time, speed, preset packages with USD prices, and — when the goal names a quantity — a `suggestion` with the exact total for that quantity. A service with an `input` needs those fields in place_order `inputs` (custom comments, accounts to mention, a hashtag, a poll option, runs, subscription terms); `input.quantity` says where the quantity comes from. `query` narrows to services whose words match, e.g. "usa", "brazil", "real", "story". Free; spends nothing. On every service, counts can drop after delivery and drops are not replaced — tell the user before they buy followers, members or likes.
| Name | Type | Req | Description |
|---|---|---|---|
| goal | string | – | What the user wants in words, e.g. "1k followers", "2.5k views, cheapest", "telegram members". |
| limit | integer | – | Most services to return (default 8). |
| link | string | – | The URL to grow, e.g. https://x.com/yourname or https://www.tiktok.com/@you/video/123. |
| query | string | – | Optional words every service returned must match: a country or region ("usa", "europe"), a quality ("real", "premium"), a kind ("story", "reels"). |
No output schema declared.
No examples provided.
get_automation Get an automation ~69
One automation with its timeline: every run, the order it placed and what that delivered, or why a run waits or was skipped (balance, budget, a daily limit).
| Name | Type | Req | Description |
|---|---|---|---|
| automation | integer | yes | The automation number (the `id` of an automation, e.g. 2001). |
No output schema declared.
No examples provided.
get_balance Get balance ~22
The user's spendable balance in USD. Orders are paid from it.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_order Get an order ~78
Status and progress of one order: status (pending, processing, completed, partial, refunded, cancelled, failed), start count, delivered, remains, charge and refunds in USD, and whether it can be cancelled now.
| Name | Type | Req | Description |
|---|---|---|---|
| order | integer | yes | The order number (the `id` field of an order, e.g. 1042). |
No output schema declared.
No examples provided.
get_quote Get a quote ~161
Exact price in USD for a quantity of one service (from find_services). Checks the quantity is within the service range. Free; spends nothing. Use it to tell the user the cost before place_order. For services with an `input`, pass the same `inputs` as for place_order; the quantity is then the units charged: the number of comments or usernames, per run × runs, or for subscriptions max × (posts + old_posts).
| Name | Type | Req | Description |
|---|---|---|---|
| inputs | object | – | Order fields, for services with an `input` (see find_services). |
| link | string | – | Optional: the link it is for. |
| quantity | integer | yes | How many units (followers, views, …). |
| service | integer | yes | Service id from find_services. |
No output schema declared.
No examples provided.
get_top_up_info How to top up ~112
How the user adds money to the balance: stablecoins (USDC, USDT or USDG, on the networks that are on) sent to their own deposit address — one address for every EVM network, another on Solana — credited 1 coin = $1, plus the top-up page link. Use it when an order fails with insufficient_balance. Tell the user to send only the listed coin on the listed network. You cannot move money yourself — give the user the address or the link.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_automations List automations ~68
The user's automations, newest first, with progress (runs placed, delivered), spend against budget and the next run. Filter by status.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | How many (default 10, max 50). |
| status | string | – | Only automations in this status. |
No output schema declared.
No examples provided.
list_orders List orders ~76
The user's orders, newest first. Filter by status; page with `before` = the smallest order number already seen.
| Name | Type | Req | Description |
|---|---|---|---|
| before | integer | – | Only orders with a smaller number than this. |
| limit | integer | – | How many (default 10, max 50). |
| status | string | – | Only orders in this status. |
No output schema declared.
No examples provided.
pause_automation Pause an automation ~55
Stop placing new runs until it is resumed (orders already running keep delivering). Nothing is charged while paused.
| Name | Type | Req | Description |
|---|---|---|---|
| automation | integer | yes | The automation number (the `id` of an automation, e.g. 2001). |
No output schema declared.
No examples provided.
place_order Place an order (spends balance) ~559
Place an order. THIS SPENDS THE USER'S REAL BALANCE (USD) and starts delivery to the link; it cannot be undone except by cancel_order where the service allows it. Before calling: get the price with get_quote and get the user's explicit agreement to that price. Then call with `confirm: true`. Without `confirm: true` nothing is charged and you get the price back so you can ask. `dry_run: true` validates everything (link fits the service, quantity range, key limits) and returns price, balance and whether it is enough — never charges. Pass a fresh `idempotency_key` per intended order so a retry never charges twice. Errors: insufficient_balance (details.shortfall = USD to top up — call get_top_up_info), over_order_cap / over_daily_cap / platform_not_allowed / read_only_key (this key's limits), wrong_platform, bad_quantity, link_busy (too many running on that link: details.available), chain_not_supported. Services with an `input` (find_services) take their fields in `inputs`: `comments` (custom comments, one per line or a list — their number is the quantity), `usernames` (accounts to mention), `hashtag`, `username`, `answer_number` (poll option, 1 = first), `runs` + `interval` (spread out; quantity is per run), or subscription terms (`min`, `max`, `posts`, `old_posts`, `delay`, `expiry`: auto-engagement on future posts, paid up front for at most max × posts). Text we post for the user is checked first: text_blocked = refused, nothing charged; a dry run says `text_review: true` when our team may check it before it starts. Errors also: bad_inputs, inputs_required. Done-for-you services (kind "manual": listings) need a form with images — those are ordered on the website.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Must be true to actually place and charge. Only after the user agreed to the price. |
| dry_run | boolean | – | true = validate and price only, never charge. |
| idempotency_key | string | – | Unique string per intended order; a retry with the same key returns the first order. |
| inputs | object | – | Order fields, for services with an `input` (see find_services). |
| link | string | yes | The URL to deliver to. Must fit the service (e.g. a profile link for followers). |
| quantity | integer | – | How many units. Leave out where the inputs count it (comments, usernames) or it is fixed (packages, subscriptions). |
| service | integer | yes | Service id from find_services. |
No output schema declared.
No examples provided.
place_orders Place several orders at once (spends balance) ~425
Place up to 25 orders in one go — several services, one link or several — paid together from the balance. THIS SPENDS THE USER'S REAL BALANCE (USD) and starts delivery. Use it when the user wants several things at once (e.g. followers + likes + views for one account); for one order use place_order. Every order is checked first at today's price: if any one cannot go (link does not fit, quantity out of range, too many running on one link, balance short…) NONE is placed and each item says why. Then they are placed one by one; should one fail at that very moment, the others stay placed and that one says why (nothing charged for it). Without `confirm: true` nothing is charged: you get each price and the total so you can ask the user. With `confirm: true` also pass `max_total` = the total the user agreed to; if prices moved above it nothing is placed (price_changed). Pass a fresh `idempotency_key` per intended batch: a retry with the same key never places an order twice. Each item takes what place_order takes: `service`, `link`, `quantity`, or `inputs` for services with an `input`. Errors: batch_invalid (details.items says which and why), insufficient_balance (details.shortfall = USD to top up — call get_top_up_info), order_rate_limited, over_daily_cap, price_changed, idempotency_conflict.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Must be true to actually place and charge. Only after the user agreed to the total. |
| dry_run | boolean | – | true = check and price only, never charge. |
| idempotency_key | string | – | Unique string per intended batch; a retry with the same key returns the first orders. |
| items | array | yes | The orders, up to 25. |
| max_total | string | – | The total in USD the user agreed to, e.g. "12.34": nothing is placed if today's prices come to more. |
No output schema declared.
No examples provided.
resume_automation Resume an automation ~75
Carry on with a paused automation: the rest of the plan moves by the time it was paused. After a price change, resuming accepts the new price for the runs left — tell the user first.
| Name | Type | Req | Description |
|---|---|---|---|
| automation | integer | yes | The automation number (the `id` of an automation, e.g. 2001). |
No output schema declared.
No examples provided.
update_automation Change a new-post automation (can raise what it spends) ~421
Change a new-post automation's settings (kind feed) while it runs, as PATCH /api/v1/automations/{id} takes them: each post's amount — quantity, or quantity_min + quantity_max (each post gets a random whole number in the range, within one delivery of the service) —, spread_minutes (30–360; 0 = all at once) + parts (2–10: each post's order in parts at random times within the window, each part at least the service's minimum, fewer parts for a small amount) and their pace (even, or "launch": the first part about half), delay_min_minutes + delay_max_minutes (the first part a random number of minutes after the post), posts (the next N posts), max_per_day and budget. Changes apply to posts found from now on; parts already planned keep their plan. Never charged above the price the plan promised. Call first without confirm: you get the settings in words and what they can cost. Tell the user. When they can cost more than its limit (change.budget.raise), the user must agree to the higher limit: then call with confirm: true and settings.confirm_budget: true (or a budget the user chose). Errors: not_editable (another kind, or it has ended), bad_quantity (outside one delivery of the service), bad_automation / bad_schedule (the message says what to change), confirm_budget (the limit would rise without the user's yes).
| Name | Type | Req | Description |
|---|---|---|---|
| automation | integer | yes | The automation number (the `id` of an automation, e.g. 2001). |
| confirm | boolean | – | Must be true to actually change it. Only after the user agreed to the new settings and what they can cost. |
| settings | object | yes | What to change, e.g. {"quantity_min": 40, "quantity_max": 60, "spread_minutes": 180, "parts": 3, "delay_min_minutes": 0, "delay_max_minutes": 30}. |
No output schema declared.
No examples provided.
How do I install the Spoofy MCP server?
Spoofy is a hosted endpoint at https://spoofy.social/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · spoofy.social
claude mcp add --transport http social-spoofy-mcp 'https://spoofy.social/mcp'
What is the Spoofy MCP server?
Spoofy is an MCP server listed in the public MCP registry as social.spoofy/mcp. Quote and order followers, views, likes and members for any public link, with spend caps. This page covers its hosted endpoint (https://spoofy.social/mcp).
Is the Spoofy MCP server safe to use?
Spoofy scores 86 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Spoofy MCP server expose?
Spoofy exposes 17 tools: find_services, get_quote, place_order, place_orders, get_order, and 12 more. Their descriptions and schemas cost roughly 3,683 tokens of context every time the server is loaded.
Does the Spoofy MCP server require authentication?
Yes. Spoofy asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the Spoofy MCP server still maintained?
Spoofy is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.