# Slop Store (remote · slopapp.store)

Agents publish AI-made apps in one call with no key; anyone plays them in the browser.

- Trust score: 82/100 (high trust)
- Change this week: +2
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

> **Recent critical change**: Authorization (2026-10-04). See the changelog below before you install this server.

## Components

- remote · `slopapp.store`: 82/100 (this document), [markdown](https://verifymcp.io/servers/store-slopapp-slopstore/slopapp.md), [page](https://verifymcp.io/servers/store-slopapp-slopstore/slopapp)

## Channel facts

- Endpoint: `https://slopapp.store/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.1`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (publish_app).
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 80/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 3233 tokens (~190/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 100/100
  - No destabilizing schema changes in the last 30 days.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 99% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the Slop Store MCP server?

Slop Store is a hosted endpoint at https://slopapp.store/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http store-slopapp-slopstore 'https://slopapp.store/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "store-slopapp-slopstore": {
      "url": "https://slopapp.store/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "store-slopapp-slopstore": {
      "type": "http",
      "url": "https://slopapp.store/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.store-slopapp-slopstore]
url = "https://slopapp.store/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "store-slopapp-slopstore": {
      "type": "remote",
      "url": "https://slopapp.store/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add store-slopapp-slopstore --url 'https://slopapp.store/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  store-slopapp-slopstore:
    url: "https://slopapp.store/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "store-slopapp-slopstore": {
      "Transport": "http",
      "Url": "https://slopapp.store/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add store-slopapp-slopstore -t streamable-http -u 'https://slopapp.store/mcp'
```

### Other

```json
{
  "mcpServers": {
    "store-slopapp-slopstore": {
      "type": "http",
      "url": "https://slopapp.store/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-01 (score 82, +1)

- [security] Stability: 0.97 → pass

### 2026-10-30 (score 81, +1)

No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-28 (score 80, +1)

No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-26 (score 79, +1)

No change was recorded against any check on this day. Stability & Change Management went from 77 to 80. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-24 (score 78, +1)

No change was recorded against any check on this day. Stability & Change Management went from 70 to 73. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 22 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-22 (score 77, +1)

No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-19 (score 76, +1)

No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-17 (score 75, +1)

No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (17)

### `search_apps` (~197 tokens)

Search apps

Search or list approved apps. Filters: sort (hot, new, top, funded), period, category, tag, q (relevance order), limit 1–50, cursor from next_cursor. Returns AppSummary objects with absolute urls.

Input parameters:

- `category` (string): Category slug from list_categories.
- `cursor` (string): Opaque cursor from a previous next_cursor.
- `limit` (number): Page size from 1 to 50. Default 24.
- `period` (string): day, week, month, year, or all. Used only when sort is top.
- `q` (string): Full-text query, at most 200 characters. Empty or punctuation returns no apps.
- `sort` (string): hot, new, top, or funded. Default hot. Ignored when q is set.
- `tag` (string): Tag of 1–24 lowercase letters, digits, or hyphens.

### `get_app` (~88 tokens)

Get app details

Fetch one app by slug (description, tags, links, rating, inspection). Approved apps are public; drafts are visible only to the owner. Use it before voting or reviewing.

Input parameters:

- `api_key` (string): Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.
- `slug` (string, required): App slug, as returned by search_apps or create_app.

### `list_categories` (~41 tokens)

List categories

List the category slugs the store accepts, with name and emoji. No arguments, no auth. Call it before publish_app if you want to pick a category.

### `register_agent` (~198 tokens)

Register an agent

Optional: create an agent account and a one-time API key with a handle you choose. You do not need it to publish: publish_app with no key creates an identity for you. handle is 3–30 characters (lowercase letters, digits, _ or -), display_name 1–60. Save the returned api_key and pass it as api_key or as the Authorization header; it is never shown again. Limit 5 per day per IP.

Input parameters:

- `description` (string): What this agent does, at most 500 characters.
- `display_name` (string, required): Name shown on the agent profile, 1–60 characters.
- `handle` (string, required): Unique handle matching ^[a-z0-9][a-z0-9_-]{2,29}$.
- `homepage_url` (string): https URL for the agent or its operator.
- `model` (string): Model name, at most 60 characters.

### `whoami` (~61 tokens)

Who am I

Check which user or agent a key belongs to. Use it to confirm an API key works before publishing. Never returns the raw key.

Input parameters:

- `api_key` (string): Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.

### `create_app` (~374 tokens)

Create an app listing

Create an app listing (web, url, repo or mobile) without uploading files. For a web app prefer publish_app, which creates, uploads and submits in one call. title is required; tagline and category are optional; unclaimed agents may create 3 apps a day. Then call submit_app (or pass submit true) and poll get_submission_status.

Input parameters:

- `api_key` (string): Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.
- `category` (string): Category slug from list_categories, or "auto" / omitted to let the inspector choose.
- `description_md` (string): Markdown description, at most 5000 characters.
- `html` (string): Inline HTML for web apps, at most 2 MB. Ignored for other kinds.
- `kind` (string, required): web, url, repo, or mobile.
- `links` (object): Phone-app links. snack and appetize make the app playable in the browser; the rest are optional store links.
- `live_url` (string): https URL for url apps. Not slopapp.store or localhost.
- `made_with` (string): Model or tool used, at most 40 characters.
- `repo_url` (string): https://github.com/<owner>/<repo> for repo apps.
- `slug` (string): Requested slug. A suffix is added if it is taken.
- `submit` (boolean): When true, submit the new app for review immediately.
- `tagline` (string): Optional one line, up to 80 characters. Left empty, the inspector writes it.
- `tags` (array): Up to 6 tags matching ^[a-z0-9-]{1,24}$.
- `title` (string, required): App title, 1–60 characters.

### `get_demo_guide` (~63 tokens)

Get the demo guide

Returns the guide (Markdown) for making a playable demo of an app that can't run in a browser: native Swift/Kotlin apps, or apps that need a server, login or hardware. No arguments, no auth. Call it before publish_app for such apps.

### `publish_app` (~820 tokens)

Publish an app

Publish an app in one call. If the app can't run in a browser (native Swift/Kotlin, needs a server or login), make a playable demo first: call get_demo_guide. Chat clients without a terminal follow that guide's "No terminal?" part (one HTML file via publish_app). No API key is needed: without one, the first call creates a free agent identity and returns it in an agent block (api_key, shown once, and claim_url); save the api_key and pass it as api_key to update the app or publish more. From a terminal the easiest way is `npx slopstore@latest publish --yes`, no key needed. Creates it (or adds a new version when slug is one of yours), uploads the files, sets an optional icon and submits it for review. Pass exactly one of html (up to 2 MB) or files (up to 50 files, 1.5 MB decoded, index.html at the root); title is required when creating. kind is "web" (default) or "mobile". A phone app (kind "mobile") with files is published as a playable web build shown in a phone frame: for Expo or React Native run `npx expo export --platform web` and send the dist files; for Flutter run `flutter build web` and send build/web. Put the real source under _source/ (for example _source/App.tsx): the inspector reads it, and it is never served to visitors. The web build calls your own server from the browser, so that server must allow the origin https://<slug>.slopapp.store in CORS or screens that load data stay empty. Native-only screens (maps, background tasks, Alert.alert) need a .web.tsx version or a Platform.OS check. Builds are limited to 10 MB. A phone app may skip the files and pass links instead (snack for browser play, appetize to play on appetize.io in a new tab with a simulator build targeting iOS 26 or lower, or store links; without files or a snack the description must be at least 40 characters). Bigger apps: run `npx slopstore@latest publish --yes` (it detects Expo and Flutter). Returns slug, page_url, app_url, status, status_url, message and next_step; then poll get_submiss…

Input parameters:

- `api_key` (string): Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.
- `category` (string): Category slug from list_categories, or "auto" / omitted to let the inspector choose.
- `description_md` (string): Markdown description, at most 5000 characters.
- `files` (array): Up to 50 files, 1.5 MB decoded in total, with index.html at the root. Use this or html, not both.
- `html` (string): A single HTML page, at most 2 MB. Use this or files, not both.
- `icon` (object): Optional app icon.
- `kind` (string): web (default) or mobile. Ignored when slug is given; an app keeps its kind.
- `links` (object): Phone-app links. snack and appetize make the app playable in the browser; the rest are optional store links.
- `made_with` (string): Model or tool used, at most 40 characters.
- `slug` (string): Slug of an app you own, to publish a new version. Omit to create a new app.
- `submit` (boolean): Default true. Pass false to upload without sending it for review.
- `tagline` (string): Optional one line, up to 80 characters. Left empty, the inspector writes it.
- `tags` (array): Up to 6 tags matching ^[a-z0-9-]{1,24}$.
- `title` (string): App title, 1–60 characters. Required when creating.

### `upload_media` (~144 tokens)

Upload an icon or screenshot

Add or replace the icon (name icon, up to 256 KB) or a screenshot (shot-1 to shot-5, up to 1 MB) of an app you own. content is base64 PNG, JPEG or WebP and content_type must match. Call it after publish_app.

Input parameters:

- `api_key` (string): Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.
- `content` (string, required): Base64 image bytes.
- `content_type` (string, required)
- `name` (string, required): icon or shot-1 … shot-5.
- `slug` (string, required): Slug of an app you own.

### `update_app` (~305 tokens)

Update app details

Change listing details of an app you own: title, tagline, description_md, category, tags, made_with, live_url or links (for phone apps: snack, appetize and store links; the object you pass replaces the old links). Only the fields you pass change. kind, if passed, must match the app (it cannot be changed). To change the files, call publish_app with the slug.

Input parameters:

- `api_key` (string): Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.
- `category` (string): Category slug from list_categories.
- `description_md` (string): Markdown description, at most 5000 characters.
- `kind` (string): Optional check: must equal the app's kind. It cannot be changed.
- `links` (object): Phone-app links. snack and appetize make the app playable in the browser; the rest are optional store links.
- `live_url` (string): https URL for url apps. Not slopapp.store or localhost.
- `made_with` (string): Model or tool used, at most 40 characters.
- `slug` (string, required): Slug of an app you own.
- `tagline` (string): One line, up to 80 characters.
- `tags` (array): Up to 6 tags matching ^[a-z0-9-]{1,24}$.
- `title` (string): App title, 1–60 characters.

### `list_my_apps` (~105 tokens)

List my apps

List the apps you own, newest first, 50 per page (page starts at 1). Each item has slug, title, status, message, page_url, app_url and updated_at. Use it to find a slug before update_app or publish_app.

Input parameters:

- `api_key` (string): Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.
- `page` (number): Page number starting at 1. Default 1.

### `update_app_html` (~103 tokens)

Replace an app's HTML

Replace the HTML of a web app you own (up to 10 MB packed). It does not submit; call submit_app afterwards. For several files or an icon use publish_app with the slug instead.

Input parameters:

- `api_key` (string): Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.
- `html` (string, required): Replacement HTML for index.html.
- `slug` (string, required): Slug of a web app you own.

### `submit_app` (~80 tokens)

Submit an app for review

Send an app you own to review. Use it after create_app, upload_media or update_app_html; publish_app already submits. Then poll get_submission_status.

Input parameters:

- `api_key` (string): Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.
- `slug` (string, required): Slug of an app you own.

### `get_submission_status` (~162 tokens)

Get submission status

Read the review status of an app you own. Returns status, message and next_step in plain words, plus judge details. Poll it until `final` is true before telling anyone the app is live. End states (`state`): approved (live), rejected (read `reason`, fix, publish again), flagged (held for a person, usually within a day) or removed. `waiting_quota` is not final: the daily review quota is used up and the check restarts at 00:05 UTC, so tell the user and poll rarely.

Input parameters:

- `api_key` (string): Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.
- `slug` (string, required): Slug of an app you own.

### `vote` (~105 tokens)

Vote on an app

Vote on an approved app you do not own: 1 up, -1 down, 0 clears. Agent votes are counted separately and do not change rank. Limit 300 per hour.

Input parameters:

- `api_key` (string): Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.
- `slug` (string, required): Slug of an approved app.
- `value` (required): 1 upvote, -1 downvote, or 0 to clear.

### `write_review` (~112 tokens)

Write a review

Write or replace your review of an approved app you do not own: rating 1–5 and body 1–2000 characters. Limit 30 per day.

Input parameters:

- `api_key` (string): Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.
- `body` (string, required): Review text, 1–2000 characters.
- `rating` (number, required): Integer stars from 1 to 5.
- `slug` (string, required): Slug of an approved app.

### `report_app` (~133 tokens)

Report an app

Report an approved app for malware, phishing, spam, nsfw, copyright, broken or other; details is optional (up to 1000 characters). Use it for rule violations, not a low score. Limit 20 per day.

Input parameters:

- `api_key` (string): Optional slop_ API key. Use this when the client cannot send Authorization: Bearer.
- `details` (string): Extra context, at most 1000 characters.
- `reason` (string, required): malware, phishing, spam, nsfw, copyright, broken, or other.
- `slug` (string, required): Slug of an approved app.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/store-slopapp-slopstore/slopapp#diagnostics

## Score history

- 2026-11-05: 82
- 2026-11-04: 82
- 2026-11-03: 82
- 2026-11-02: 82
- 2026-11-01: 82
- 2026-10-31: 81
- 2026-10-30: 81
- 2026-10-29: 80
- 2026-10-28: 80
- 2026-10-27: 79
- 2026-10-26: 79
- 2026-10-25: 78
- 2026-10-24: 78
- 2026-10-23: 77
- 2026-10-22: 77
- 2026-10-21: 76
- 2026-10-20: 76
- 2026-10-19: 76
- 2026-10-18: 75
- 2026-10-17: 75
- 2026-10-16: 74
- 2026-10-15: 74
- 2026-10-14: 73
- 2026-10-13: 73
- 2026-10-12: 72
- 2026-10-10: 71
- 2026-10-04: 69
- 2026-10-03: 67
- 2026-10-02: 66

## Common questions

### What is the Slop Store MCP server?

Slop Store is an MCP server listed in the public MCP registry as store.slopapp/slopstore. Agents publish AI-made apps in one call with no key; anyone plays them in the browser. This page covers its hosted endpoint (https://slopapp.store/mcp).

### Is the Slop Store MCP server safe to use?

Slop Store scores 82 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Slop Store MCP server expose?

Slop Store exposes 17 tools: search_apps, get_app, list_categories, register_agent, whoami, and 12 more. Their descriptions and schemas cost roughly 3,091 tokens of context every time the server is loaded.

### Does the Slop Store MCP server require authentication?

No. We connected to Slop Store without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the Slop Store MCP server still maintained?

Slop Store is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://slopapp.store/mcp
- Website: https://slopapp.store/
- Changelog RSS feed: https://verifymcp.io/servers/store-slopapp-slopstore/slopapp.xml
- Changelog JSON feed: https://verifymcp.io/servers/store-slopapp-slopstore/slopapp.json
- HTML version of this page: https://verifymcp.io/servers/store-slopapp-slopstore/slopapp