io.github.sonpiaz/openaffiliate-mcp
REMOTE · OPENAFFILIATE.DEV · 2 COMPONENTS
Search and discover affiliate programs with agent-ready data and commission details.
Available components
Last scanned (19 minutes ago)
Scores higher than 97% of remote servers
Reachable. Last reached 6 Nov 2026.
Category Marketing and SEO
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security80
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Nothing on it is marked destructive, but we can't show that an anonymous caller can only read: full credit needs the server to list at least one tool and every tool to be verifiably read-only. We use a best-effort check of tool names and descriptions to tell read-only tools from tools that change things, so some genuinely read-only tools may not get full credit. Names that start with a read verb (get, list, read, search and similar) and accurate readOnlyHint annotations help. Meet that to earn full credit, or require authorisation. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability83
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 921 tokens (~153/item across 6 items; 5 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 5 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 7 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Checks we ran (13)
- TLS certificate
- Authorization
- HTTPS
- HSTS header
- DNSSEC
- Transport
- Schema quality
- Stability
- Tool coverage
- Injection markers
- Destructive annotations
- Judged manipulation
- MCP protocol
Does not apply to this hosted endpoint (2)
- Supply Chain SecurityScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
- Provenance & TransparencyScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 6 Nov 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 22 Oct 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Schema quality: 570 → 921 ▼ functional
- Server version: 0.1.2 → 0.1.3 functional
- New tool “get_submission_status” functional
- New tool “submit_program” functional
- 20 Oct 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “get_program” rewrote its description, which is the text the model reads security
- Tool “list_categories” rewrote its description, which is the text the model reads security
- Tool “search_programs” rewrote its description, which is the text the model reads security
- Schema quality: pass → fail ▼ functional
- Tool “get_program” now declares an output schema ▲ functional
- Tool “list_categories” now declares an output schema ▲ functional
- Tool “search_programs” now declares an output schema ▲ functional
- The server now declares the “resources” capability functional
- First check of Schema quality: 100 functional
- First check of Tool coverage: 100 functional
- New resource “categories” functional
- Server version: 0.1.0 → 0.1.2 functional
- “get_program” reworded the description of “slug” cosmetic
- “search_programs” reworded the description of “category” cosmetic
- “search_programs” reworded the description of “commission_type” cosmetic
- “search_programs” reworded the description of “verified_only” cosmetic
- 10 Oct 26 +10
- Transport: fail → pass ▲ security
- 7 Oct 26 −10
- Transport: pass → fail ▼ security
- 28 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 26 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 6 Nov 2026 · Probed https://openaffiliate.dev/api/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=openaffiliate.dev | CN=YR1,O=Let's Encrypt,C=US | 19 Oct 2026 | 17 Jan 2027 | RSA 2048 | SHA256-RSA | 67077a98d52cbae35fd88487e163cd6320c |
| SANs: openaffiliate.dev | ||||||
| CN=YR1,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | a20253f15f2691c05dc1ce13b9bcca4e |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of openaffiliate.dev. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | Trust anchor | 20326, 38696 | 8, 8 | Verified |
| dev. | DS published | 60074 | 8 | Verified |
| openaffiliate.dev. | No DS | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=63072000 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://openaffiliate.dev/api/mcp | Verified | 200 | |
| http (plaintext) | http://openaffiliate.dev/api/mcp | HTTPS enforced | 308 | https://openaffiliate.dev/api/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
get_program Get Program ~136
Use with a known slug or alias to read full program details, status, agentPrompt recommendation guidance, restrictions, signup information, and a citable markdownUrl. Also returns paused entries and dated answers with alternatives for discontinued or no_program brands. Do not use for broad discovery; call search_programs first if the slug is unknown. Read status and agentPrompt before recommending; if no entry exists, use search_programs to find a match.
| Name | Type | Req | Description |
|---|---|---|---|
| slug | string | yes | Use the slug from search_programs results or the final segment of a program URL (e.g. /programs/vercel). Aliases resolve to the canonical program |
| Name | Type | Req | Description |
|---|---|---|---|
| agentKeywords | array | – | Semantic keywords for matching user needs; empty when none are stored |
| agentPrompt | string | yes | Recommendation guidance and conditions; read before recommending |
| agentUseCases | array | – | Recommendation scenarios; unverified term claims are withheld; empty when none remain |
| aliases | array | – | Alternative slugs accepted by get_program; empty when none are stored |
| alsoOn | – | – | Additional marketplace listings; null when none are stored, omitted for discontinued/no_program |
| alternatives | array | – | Verified, active cash-paying alternatives in the same category; only returned for discontinued/no_program, empty when none match |
| answer | string | – | Answer explaining the lack of an affiliate program, dated when a check date exists; only returned for discontinued/no_program |
| apiAvailable | boolean | – | Whether an affiliate API is available; omitted when unspecified or discontinued/no_program, not an implied false |
| approval | string | – | Application approval process: auto, manual or invite-only; omitted when unverified, unspecified or discontinued/no_program |
| approvalTime | – | – | Expected application review time as source text; null when unspecified, omitted when unverified or discontinued/no_program |
| attribution | string | – | Referral attribution model, such as last-click; omitted when unspecified or discontinued/no_program |
| category | string | yes | Exact registry category name, as returned by list_categories |
| claimedBy | – | – | Verified owner domain that claimed the listing, never an email address; null when unclaimed |
| commission | object | yes | Commission structure, figures and earning conditions; unverified terms are unconfirmed, while discontinued/no_program entries return neutral placeholders |
| commissionConditions | – | – | Same earning conditions as commission.conditions; null when unavailable, omitted for discontinued/no_program |
| commissionDuration | – | – | Same duration text as commission.duration; null when unspecified, omitted for discontinued/no_program |
| cookieDays | number | – | Attribution window in days; omitted until terms are verified |
| createdAt | string | yes | Registry entry creation date in YYYY-MM-DD form; empty when unspecified |
| dashboardUrl | – | – | Affiliate dashboard URL; null when unspecified, omitted for discontinued/no_program |
| dedicatedManager | boolean | – | Whether a dedicated affiliate manager is provided; omitted when unspecified or discontinued/no_program, not an implied false |
| description | string | yes | Full product and program description; unverified cookie, payout and approval claims are withheld |
| kind | string | – | Income program model: affiliate commissions, customer referrals, creator payouts, revenue sharing, cashback or a partner network; omitted when unspecified or discontinued/no_program |
| lastVerifiedAt | – | – | Date terms were checked, in YYYY-MM-DD form; null when unspecified, omitted for unverified or discontinued/no_program entries |
| logo | string | yes | Text logo placeholder: the uppercase first character of the brand name, not an image URL |
| markdownUrl | string | yes | Citable program page in Markdown on openaffiliate.dev |
| marketingMaterials | boolean | – | Whether promotional assets are provided; omitted when unspecified or discontinued/no_program, not an implied false |
| name | string | yes | Display name of the program or brand |
| network | – | – | Affiliate network identifier, such as partnerstack or in-house; null when unknown, omitted for discontinued/no_program |
| oas | object | – | OAS, the OpenAffiliate Score: how clearly the program publishes its terms and protects its partners. Omitted when the program is not scored or OAS is not published |
| oasMachineChecks | array | – | Machine checks shown on the OAS report, not counted in OAS; omitted when there are none to show |
| payout | object | yes | Published payout terms; empty when terms are unverified or no program exists |
| payoutMethods | array | – | Same methods as payout.methods; empty when none are stored, omitted when unverified or discontinued/no_program |
| programAge | – | – | How long the program has existed, as source text without a fixed unit; null when unspecified, omitted for discontinued/no_program |
| restrictions | array | – | Program rules and prohibited promotion methods; unverified term claims are withheld; empty when none remain, omitted for discontinued/no_program |
| shortDescription | string | yes | Brief product summary; unverified cookie, payout and approval claims are withheld |
| signupUrl | string | – | Affiliate signup or program URL; omitted when not stored or status is discontinued/no_program |
| slug | string | yes | Canonical slug, including when the input was an alias |
| source | string | – | Registry source identifier or URL; omitted when unspecified |
| stars | number | yes | Legacy star-count placeholder, currently always 0; not a program quality score |
| status | string | – | Availability: active is listed in search; paused is temporarily unavailable; discontinued means closed; no_program means no public program found. Non-active entries are excluded from search; missing… |
| statusCheckedAt | string | – | YYYY-MM-DD date the discontinued/no_program status was checked, not verification of terms; omitted for other statuses or when no check date is stored |
| statusNote | – | – | Explanation and source for the program's status; null when unspecified |
| submittedBy | string | yes | Registry submitter identifier; defaults to community |
| tags | array | yes | Searchable product and program tags; empty when none are stored |
| trackingMethod | string | – | How referrals are tracked, such as cookie, link or coupon; omitted when unspecified or discontinued/no_program |
| updatedAt | string | – | Registry entry update date in YYYY-MM-DD form; omitted when unspecified |
| url | string | yes | Brand's product or website URL |
| verified | boolean | yes | True when the terms have been checked on the brand's own program page; false means unconfirmed |
No examples provided.
get_submission_status Get Submission Status ~74
Use with an id from submit_program to read where a submitted program is: queued, verifying, listed (with listingUrl and, once scored, reportUrl) or rejected (with reason). Do not use to look up listed programs; call get_program for those.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The id submit_program returned |
| Name | Type | Req | Description |
|---|---|---|---|
| createdAt | string | – | When the submission was made, ISO 8601 |
| duplicate | boolean | – | True when this domain was already in the queue; the existing submission is returned |
| id | string | – | Submission id for get_submission_status; omitted when the domain is already listed |
| listingUrl | string | – | The program's page on openaffiliate.dev when it is listed |
| reason | string | – | Why a submission was rejected, in one sentence |
| reportUrl | string | – | The program's OAS report when it is scored |
| status | string | yes | queued: waiting for a maintainer; verifying: terms being checked on the brand's own page; listed: on OpenAffiliate; rejected: see reason |
| statusUrl | string | – | REST URL that returns this submission's status |
| updatedAt | string | – | When its status last changed, ISO 8601 |
No examples provided.
list_categories List Categories ~60
Use to browse category names and active program counts before filtering a search. Returns all registry categories, including categories with zero active listings. Do not use for program details or commission comparisons; call search_programs with a returned category, then get_program for individual terms.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| categories | array | yes | All registry categories and their active program counts, including zero counts |
No examples provided.
search_programs Search Programs ~232
Use to discover active affiliate programs by keyword, category, commission type, or verified status. Returns matching summaries with canonical slugs, commission figures, signup links, and citable markdownUrl fields. Do not use to check a known brand's paused or no-program status; call get_program with its slug. Call list_categories for category names, then get_program for recommendation guidance and restrictions before recommending a match.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Filter by exact category name as returned by list_categories (case-sensitive, not a slug), e.g. 'AI', 'Email Marketing' |
| commission_type | string | – | Filter by payment structure: recurring = paid on each renewal within the commission duration; one-time = paid once per qualifying referral; tiered = commission varies by performance level. Omit to in… |
| query | string | – | Search keyword to match against name, description, tags, or category |
| verified_only | boolean | – | When true, return only programs whose terms were checked on the brand's own program page. False or omitted includes unverified programs with unconfirmed terms |
| Name | Type | Req | Description |
|---|---|---|---|
| programs | array | yes | Matching active programs; empty when no listings match |
No examples provided.
submit_program Submit Program ~222
Use when get_program and search_programs do not find a brand's affiliate program: queues the brand's own program page for a maintainer to verify against the brand's published terms. Not instant: nothing is listed and no score exists until the terms are verified. A domain already listed returns its listingUrl instead; a domain already queued returns the existing submission. Send the brand's own program or partners page, never a network or review site. Never invent terms. Then call get_submission_status with the returned id.
| Name | Type | Req | Description |
|---|---|---|---|
| contact | string | – | Optional email for the person submitting; never shown publicly and never returned by any tool |
| name | string | – | Brand or program name, up to 100 characters |
| note | string | – | Optional note for the maintainer, up to 1000 characters |
| programUrl | string | yes | https:// link to the affiliate or partner program page on the brand's own website |
| termsUrl | string | – | https:// link to the page that states the program's terms, when it is a different page |
| Name | Type | Req | Description |
|---|---|---|---|
| createdAt | string | – | When the submission was made, ISO 8601 |
| duplicate | boolean | – | True when this domain was already in the queue; the existing submission is returned |
| id | string | – | Submission id for get_submission_status; omitted when the domain is already listed |
| listingUrl | string | – | The program's page on openaffiliate.dev when it is listed |
| reason | string | – | Why a submission was rejected, in one sentence |
| reportUrl | string | – | The program's OAS report when it is scored |
| status | string | yes | queued: waiting for a maintainer; verifying: terms being checked on the brand's own page; listed: on OpenAffiliate; rejected: see reason |
| statusUrl | string | – | REST URL that returns this submission's status |
| updatedAt | string | – | When its status last changed, ISO 8601 |
No examples provided.
How do I install the io.github.sonpiaz/openaffiliate-mcp server?
io.github.sonpiaz/openaffiliate-mcp is a hosted endpoint at https://openaffiliate.dev/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · openaffiliate.dev
claude mcp add --transport http sonpiaz-openaffiliate-mcp 'https://openaffiliate.dev/api/mcp'
What is the io.github.sonpiaz/openaffiliate-mcp server?
io.github.sonpiaz/openaffiliate-mcp is listed in the public MCP registry as io.github.sonpiaz/openaffiliate-mcp. Search and discover affiliate programs with agent-ready data and commission details. This page covers its hosted endpoint (https://openaffiliate.dev/api/mcp).
Is the io.github.sonpiaz/openaffiliate-mcp server safe to use?
io.github.sonpiaz/openaffiliate-mcp scores 89 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.sonpiaz/openaffiliate-mcp server expose?
io.github.sonpiaz/openaffiliate-mcp exposes 5 tools: search_programs, get_program, list_categories, submit_program, get_submission_status. Their descriptions and schemas cost roughly 724 tokens of context every time the server is loaded.
Does the io.github.sonpiaz/openaffiliate-mcp server require authentication?
No. We connected to io.github.sonpiaz/openaffiliate-mcp without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the io.github.sonpiaz/openaffiliate-mcp server still maintained?
io.github.sonpiaz/openaffiliate-mcp is still listed as active in the MCP registry. We last reached this channel on 6 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What did VerifyMCP test on the io.github.sonpiaz/openaffiliate-mcp server?
VerifyMCP ran 13 checks on io.github.sonpiaz/openaffiliate-mcp, covering TLS certificate, Authorization, HTTPS, HSTS header and 9 more. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.