# Spoofy (remote · spoofy.social)

Quote and order followers, views, likes and members for any public link, with spend caps.

- Trust score: 86/100 (high trust)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `spoofy.social`: 86/100 (this document), [markdown](https://verifymcp.io/servers/social-spoofy-mcp/spoofy.md), [page](https://verifymcp.io/servers/social-spoofy-mcp/spoofy)

## Channel facts

- Endpoint: `https://spoofy.social/mcp`
- Transports: `streamable-http`
- Auth: `required`
- Version: `1.2.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 97/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
  - The authorisation server supports Client ID Metadata Documents, the current MCP client-registration mechanism.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 63/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 4186 tokens (~246/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 57/100
  - Stability observed for 17 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 17 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the Spoofy MCP server?

Spoofy is a hosted endpoint at https://spoofy.social/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http social-spoofy-mcp 'https://spoofy.social/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "social-spoofy-mcp": {
      "url": "https://spoofy.social/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "social-spoofy-mcp": {
      "type": "http",
      "url": "https://spoofy.social/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.social-spoofy-mcp]
url = "https://spoofy.social/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "social-spoofy-mcp": {
      "type": "remote",
      "url": "https://spoofy.social/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add social-spoofy-mcp --url 'https://spoofy.social/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  social-spoofy-mcp:
    url: "https://spoofy.social/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "social-spoofy-mcp": {
      "Transport": "http",
      "Url": "https://spoofy.social/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add social-spoofy-mcp -t streamable-http -u 'https://spoofy.social/mcp'
```

### Other

```json
{
  "mcpServers": {
    "social-spoofy-mcp": {
      "type": "http",
      "url": "https://spoofy.social/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-04 (score 86, +1)

No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-02 (score 85, +1)

No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-31 (score 84, +1)

No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-29 (score 83, +1)

- [security] Tool “create_automation” rewrote its description, which is the text the model reads
- [security] Tool “update_automation” rewrote its description, which is the text the model reads

### 2026-10-28 (score 82, 0)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] New tool “update_automation”, which the server declares destructive
- [security] Tool “create_automation” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 3629 → 4147

### 2026-10-27 (score 82, 0)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] New tool “add_automation_link”, which the server declares destructive
- [security] Tool “create_automation” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 3192 → 3629

### 2026-10-26 (score 82, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-24 (score 81, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (17)

### `find_services` (~418 tokens)

Find services

Find what Spoofy can do for a link or a goal, with prices. ALWAYS call this first: service ids come from here. Give `link` (any profile, post, video, channel, group, token page or website URL) and/or `goal` in plain words, e.g. "500 followers on my tiktok" or "cheap views for this YouTube video". With a link you only get services that fit that exact link (a profile link gets followers, a post link gets likes/views). Returns matching services: `service` (the id to quote/order), name, tier (basic/standard/premium), pricePer1k (USD per 1,000 units), min/max quantity, start time, speed, preset packages with USD prices, and — when the goal names a quantity — a `suggestion` with the exact total for that quantity. A service with an `input` needs those fields in place_order `inputs` (custom comments, accounts to mention, a hashtag, a poll option, runs, subscription terms); `input.quantity` says where the quantity comes from. `query` narrows to services whose words match, e.g. "usa", "brazil", "real", "story". Free; spends nothing. On every service, counts can drop after delivery and drops are not replaced — tell the user before they buy followers, members or likes.

Input parameters:

- `goal` (string): What the user wants in words, e.g. "1k followers", "2.5k views, cheapest", "telegram members".
- `limit` (integer): Most services to return (default 8).
- `link` (string): The URL to grow, e.g. https://x.com/yourname or https://www.tiktok.com/@you/video/123.
- `query` (string): Optional words every service returned must match: a country or region ("usa", "europe"), a quality ("real", "premium"), a kind ("story", "reels").

### `get_quote` (~161 tokens)

Get a quote

Exact price in USD for a quantity of one service (from find_services). Checks the quantity is within the service range. Free; spends nothing. Use it to tell the user the cost before place_order. For services with an `input`, pass the same `inputs` as for place_order; the quantity is then the units charged: the number of comments or usernames, per run × runs, or for subscriptions max × (posts + old_posts).

Input parameters:

- `inputs` (object): Order fields, for services with an `input` (see find_services).
- `link` (string): Optional: the link it is for.
- `quantity` (integer, required): How many units (followers, views, …).
- `service` (integer, required): Service id from find_services.

### `place_order` (~559 tokens)

Place an order (spends balance)

Place an order. THIS SPENDS THE USER'S REAL BALANCE (USD) and starts delivery to the link; it cannot be undone except by cancel_order where the service allows it. Before calling: get the price with get_quote and get the user's explicit agreement to that price. Then call with `confirm: true`. Without `confirm: true` nothing is charged and you get the price back so you can ask. `dry_run: true` validates everything (link fits the service, quantity range, key limits) and returns price, balance and whether it is enough — never charges. Pass a fresh `idempotency_key` per intended order so a retry never charges twice. Errors: insufficient_balance (details.shortfall = USD to top up — call get_top_up_info), over_order_cap / over_daily_cap / platform_not_allowed / read_only_key (this key's limits), wrong_platform, bad_quantity, link_busy (too many running on that link: details.available), chain_not_supported. Services with an `input` (find_services) take their fields in `inputs`: `comments` (custom comments, one per line or a list — their number is the quantity), `usernames` (accounts to mention), `hashtag`, `username`, `answer_number` (poll option, 1 = first), `runs` + `interval` (spread out; quantity is per run), or subscription terms (`min`, `max`, `posts`, `old_posts`, `delay`, `expiry`: auto-engagement on future posts, paid up front for at most max × posts). Text we post for the user is checked first: text_blocked = refused, nothing charged; a dry run says `text_review: true` when our team may check it before it starts. Errors also: bad_inputs, inputs_required. Done-for-you services (kind "manual": listings) need a form with images — those are ordered on the website.

Input parameters:

- `confirm` (boolean): Must be true to actually place and charge. Only after the user agreed to the price.
- `dry_run` (boolean): true = validate and price only, never charge.
- `idempotency_key` (string): Unique string per intended order; a retry with the same key returns the first order.
- `inputs` (object): Order fields, for services with an `input` (see find_services).
- `link` (string, required): The URL to deliver to. Must fit the service (e.g. a profile link for followers).
- `quantity` (integer): How many units. Leave out where the inputs count it (comments, usernames) or it is fixed (packages, subscriptions).
- `service` (integer, required): Service id from find_services.

### `place_orders` (~425 tokens)

Place several orders at once (spends balance)

Place up to 25 orders in one go — several services, one link or several — paid together from the balance. THIS SPENDS THE USER'S REAL BALANCE (USD) and starts delivery. Use it when the user wants several things at once (e.g. followers + likes + views for one account); for one order use place_order. Every order is checked first at today's price: if any one cannot go (link does not fit, quantity out of range, too many running on one link, balance short…) NONE is placed and each item says why. Then they are placed one by one; should one fail at that very moment, the others stay placed and that one says why (nothing charged for it). Without `confirm: true` nothing is charged: you get each price and the total so you can ask the user. With `confirm: true` also pass `max_total` = the total the user agreed to; if prices moved above it nothing is placed (price_changed). Pass a fresh `idempotency_key` per intended batch: a retry with the same key never places an order twice. Each item takes what place_order takes: `service`, `link`, `quantity`, or `inputs` for services with an `input`. Errors: batch_invalid (details.items says which and why), insufficient_balance (details.shortfall = USD to top up — call get_top_up_info), order_rate_limited, over_daily_cap, price_changed, idempotency_conflict.

Input parameters:

- `confirm` (boolean): Must be true to actually place and charge. Only after the user agreed to the total.
- `dry_run` (boolean): true = check and price only, never charge.
- `idempotency_key` (string): Unique string per intended batch; a retry with the same key returns the first orders.
- `items` (array, required): The orders, up to 25.
- `max_total` (string): The total in USD the user agreed to, e.g. "12.34": nothing is placed if today's prices come to more.

### `get_order` (~78 tokens)

Get an order

Status and progress of one order: status (pending, processing, completed, partial, refunded, cancelled, failed), start count, delivered, remains, charge and refunds in USD, and whether it can be cancelled now.

Input parameters:

- `order` (integer, required): The order number (the `id` field of an order, e.g. 1042).

### `list_orders` (~76 tokens)

List orders

The user's orders, newest first. Filter by status; page with `before` = the smallest order number already seen.

Input parameters:

- `before` (integer): Only orders with a smaller number than this.
- `limit` (integer): How many (default 10, max 50).
- `status` (string): Only orders in this status.

### `cancel_order` (~71 tokens)

Cancel an order

Ask to cancel a pending or processing order (only when the order says cancelable: true). Whatever was not delivered is refunded to the balance in USD. Confirm with the user first.

Input parameters:

- `order` (integer, required): The order number (the `id` field of an order, e.g. 1042).

### `get_balance` (~22 tokens)

Get balance

The user's spendable balance in USD. Orders are paid from it.

### `get_top_up_info` (~112 tokens)

How to top up

How the user adds money to the balance: stablecoins (USDC, USDT or USDG, on the networks that are on) sent to their own deposit address — one address for every EVM network, another on Solana — credited 1 coin = $1, plus the top-up page link. Use it when an order fails with insufficient_balance. Tell the user to send only the listed coin on the listed network. You cannot move money yourself — give the user the address or the link.

### `create_automation` (~742 tokens)

Set up an automation (spends balance as it runs)

Set up an automation: Spoofy places ordinary orders for the user on a plan. Kinds: spread (a total over time, e.g. {"kind":"spread","service":12,"link":"…","quantity":10000,"over":"3d"}; pace "steady" or "front" for an S-curve growth plan, "launch" for about half straight away then each run smaller), scheduled (one order at start_at), recurring (every "1d"/"6h"/"1w", optional at "14:00" + timezone, with times, until or budget), split (past one order's max), campaign (steps [{service, link, quantity, offset_minutes, over_minutes}] or template: "token-launch" + links), keep_above (target + days + budget; public Telegram channels/groups and YouTube videos only), feed (a public Telegram channel, YouTube channel, CoinMarketCap Community profile, Pinterest profile or board, Bluesky account, Reddit user or subreddit, RSS feed, or an X account while X's API is on: every new post gets quantity of service — or quantity_min + quantity_max, a random whole number in that range for each post; spread_minutes (30–360) + parts (2–10) splits each post's order into parts at random times within the window, each at least the service's minimum (pace "launch": the first part about half); delay_min_minutes + delay_max_minutes start it a random number of minutes after the post; posts: the next N posts, then it completes — "likes on my next 30 posts" is posts 30, no days needed; max_per_day; budget, needed only without posts; change them later with update_automation), per_link (a new post each run: service, quantity each run, runs, optional every "daily" + at "14:00" and days; no link now — each run goes out when its post's link is sent with add_automation_link; runs not used are never charged). For new posts elsewhere (Instagram, TikTok …) order an "On new posts" service instead (find_services; fields username, min, max, posts, delay): the provider watches the account. Service ids come from find_services. THIS SPENDS THE USER'S REAL BALANCE: each run is charged when it goes (never above th…

Input parameters:

- `automation` (object, required): The automation, exactly as POST /api/v1/automations takes it: {"kind": …, "service": …, "link": …, …}.
- `confirm` (boolean): Must be true to actually create it. Only after the user agreed to the plan and its cost.
- `dry_run` (boolean): true = plan and price only, create nothing.
- `idempotency_key` (string): Unique string per intended automation; a retry with the same key returns the first one.

### `list_automations` (~68 tokens)

List automations

The user's automations, newest first, with progress (runs placed, delivered), spend against budget and the next run. Filter by status.

Input parameters:

- `limit` (integer): How many (default 10, max 50).
- `status` (string): Only automations in this status.

### `get_automation` (~69 tokens)

Get an automation

One automation with its timeline: every run, the order it placed and what that delivered, or why a run waits or was skipped (balance, budget, a daily limit).

Input parameters:

- `automation` (integer, required): The automation number (the `id` of an automation, e.g. 2001).

### `update_automation` (~421 tokens)

Change a new-post automation (can raise what it spends)

Change a new-post automation's settings (kind feed) while it runs, as PATCH /api/v1/automations/{id} takes them: each post's amount — quantity, or quantity_min + quantity_max (each post gets a random whole number in the range, within one delivery of the service) —, spread_minutes (30–360; 0 = all at once) + parts (2–10: each post's order in parts at random times within the window, each part at least the service's minimum, fewer parts for a small amount) and their pace (even, or "launch": the first part about half), delay_min_minutes + delay_max_minutes (the first part a random number of minutes after the post), posts (the next N posts), max_per_day and budget. Changes apply to posts found from now on; parts already planned keep their plan. Never charged above the price the plan promised. Call first without confirm: you get the settings in words and what they can cost. Tell the user. When they can cost more than its limit (change.budget.raise), the user must agree to the higher limit: then call with confirm: true and settings.confirm_budget: true (or a budget the user chose). Errors: not_editable (another kind, or it has ended), bad_quantity (outside one delivery of the service), bad_automation / bad_schedule (the message says what to change), confirm_budget (the limit would rise without the user's yes).

Input parameters:

- `automation` (integer, required): The automation number (the `id` of an automation, e.g. 2001).
- `confirm` (boolean): Must be true to actually change it. Only after the user agreed to the new settings and what they can cost.
- `settings` (object, required): What to change, e.g. {"quantity_min": 40, "quantity_max": 60, "spread_minutes": 180, "parts": 3, "delay_min_minutes": 0, "delay_max_minutes": 30}.

### `pause_automation` (~55 tokens)

Pause an automation

Stop placing new runs until it is resumed (orders already running keep delivering). Nothing is charged while paused.

Input parameters:

- `automation` (integer, required): The automation number (the `id` of an automation, e.g. 2001).

### `resume_automation` (~75 tokens)

Resume an automation

Carry on with a paused automation: the rest of the plan moves by the time it was paused. After a price change, resuming accepts the new price for the runs left — tell the user first.

Input parameters:

- `automation` (integer, required): The automation number (the `id` of an automation, e.g. 2001).

### `cancel_automation` (~94 tokens)

Cancel an automation

Stop an automation for good: every future run is cancelled. Orders already running finish, unless cancel_running: true asks those that allow it to cancel too (the undelivered part is refunded). Confirm with the user first.

Input parameters:

- `automation` (integer, required): The automation number (the `id` of an automation, e.g. 2001).
- `cancel_running` (boolean): Also ask its running orders to cancel.

### `add_automation_link` (~237 tokens)

Send a post to a plan (spends one run)

For an automation of kind per_link ("a new post each run"): the link of its next run — the new post, video or track the user wants it on. The run goes out at once as an ordinary order at the price the plan was set up with, charged from the balance (one run of the plan the user already agreed to; nothing else is charged). The link must be one the plan takes (its platform and kind: a post plan takes posts, never a profile or a token page), and each link takes one run only. Errors: not_per_link, wrong_platform / wrong_link_kind (the message says what the plan takes), link_already_used, no_runs_left, automation_ended, automation_paused. A short balance keeps the run waiting and pauses the plan until a top-up covers it; it then goes by itself.

Input parameters:

- `automation` (integer, required): The automation number (the `id` of an automation, e.g. 2001).
- `link` (string, required): The new post's full link, e.g. https://coinmarketcap.com/community/post/123456789.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/social-spoofy-mcp/spoofy#diagnostics

## Score history

- 2026-11-05: 86
- 2026-11-04: 86
- 2026-11-03: 85
- 2026-11-02: 85
- 2026-11-01: 84
- 2026-10-31: 84
- 2026-10-30: 83
- 2026-10-29: 83
- 2026-10-28: 82
- 2026-10-27: 82
- 2026-10-26: 82
- 2026-10-25: 81
- 2026-10-24: 81
- 2026-10-23: 80
- 2026-10-22: 80
- 2026-10-21: 79
- 2026-10-20: 79
- 2026-10-19: 79

## Common questions

### What is the Spoofy MCP server?

Spoofy is an MCP server listed in the public MCP registry as social.spoofy/mcp. Quote and order followers, views, likes and members for any public link, with spend caps. This page covers its hosted endpoint (https://spoofy.social/mcp).

### Is the Spoofy MCP server safe to use?

Spoofy scores 86 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Spoofy MCP server expose?

Spoofy exposes 17 tools: find_services, get_quote, place_order, place_orders, get_order, and 12 more. Their descriptions and schemas cost roughly 3,683 tokens of context every time the server is loaded.

### Does the Spoofy MCP server require authentication?

Yes. Spoofy asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

### Is the Spoofy MCP server still maintained?

Spoofy is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://spoofy.social/mcp
- Website: https://spoofy.social/developers?utm_source=mcp-registry&utm_medium=listing&utm_campaign=mcp
- Changelog RSS feed: https://verifymcp.io/servers/social-spoofy-mcp/spoofy.xml
- Changelog JSON feed: https://verifymcp.io/servers/social-spoofy-mcp/spoofy.json
- HTML version of this page: https://verifymcp.io/servers/social-spoofy-mcp/spoofy