Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Docstar

REMOTE · MCP.DOCSTAR.IO

Publish your API docs so AI assistants can look up endpoints and call your API correctly.

Available components

+3 this week 65 Trust /100

Last scanned (1 hour ago)

Scores higher than 45% of remote servers

Reachable. Last reached 5 Nov 2026.

Category Code Search and Documentation

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security57
Transport & Reachability100
Schema Quality & AI Usability57
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 5187 tokens (~345/item across 15 items; 15 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management29
  • Stability check failed: schema churn in the 10 days we've observed: 0 tool removals, 1 breaking changes, 0 auth/transport breaks, 0 additions. See how to fix → Fail
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 16 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 4 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 23 to 26.

  • 2 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 16 to 19.

  • 31 Oct 26 +1
    • Tool “create_collection” rewrote its description, which is the text the model reads security
    • Tool “quickstart-docstar” rewrote its description, which is the text the model reads security
  • 30 Oct 26 0
    • The server rewrote its instructions, which are the text every model session reads security
    • Schema quality: excellent → good functional
  • 29 Oct 26 0
    • The server rewrote its instructions, which are the text every model session reads security
  • 28 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 0 to 3.

  • 27 Oct 26 0
    • Stability: unverified → fail ▼ security
    • Stability: unverified → 0.03 ▲ functional
    • This server's schema is too large to store in full, so we cannot compare its tools day to day functional
  • 26 Oct 26 61

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Probed https://mcp.docstar.io/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=mcp.docstar.io CN=WR3,O=Google Trust Services,C=US 16 Oct 2026 14 Jan 2027 RSA 2048 SHA256-RSA 868f0cbd6939bf9e127b49bcf7610f12
SANs: mcp.docstar.io
CN=WR3,O=Google Trust Services,C=US (CA) CN=GTS Root R1,O=Google Trust Services LLC,C=US 13 Dec 2023 20 Feb 2029 RSA 2048 SHA256-RSA 7ff005a91568d63abc22861684aa4b5a
CN=GTS Root R1,O=Google Trust Services LLC,C=US (CA) CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE 19 Jun 2020 28 Jan 2028 RSA 4096 SHA256-RSA 77bd0d6cdb36f91aea210fc4f058d30d

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of mcp.docstar.io. — Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
io. present 38690 8 Verified
docstar.io. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://mcp.docstar.io/mcp Verified 200
http (plaintext) http://mcp.docstar.io/mcp HTTPS enforced 301 https://mcp.docstar.io:443/mcp
MCP tools · 15 exposed · ~5,106 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
call_any_api_of_docstar ~388

Send a POST, PUT, PATCH or DELETE request to any DocStar API endpoint for the signed-in user and return { status, ok, headers, data }. Use it for changes no dedicated tool covers, once you know the exact endpoint: from the quickstart-docstar skill's recipes, or looked up with get_docstar_api_docs. For GET requests use call_any_read_api_of_docstar. Never guess a URL. Pass the full url with path variables filled in, the method, the headers the endpoint's docs list, query params in `query` (not in the url) and the JSON body in `body`. Send the endpoint's auth header with an empty value "": the user's token is filled in automatically. Never put a token there yourself. Show the user what you're about to send and get a yes before any call that creates, changes, publishes or deletes something.

NameTypeReqDescription
bodyobject–JSON request body, as the endpoint's docs show it. Leave it out when the endpoint takes no body.
headersobjectyesRequest headers as name/value pairs, as the docs list them. Give the auth header (Authorization, proxy_auth_token, x-api-key, ...) an empty value "" so the signed-in user's token is filled in; never…
methodstringyesHTTP method from the endpoint's docs
queryobject–Query params as name/value pairs; an array sends the param once per item. Example: {"type": "flow", "bringflows": true}
urlstringyesFull endpoint URL with path variables replaced by real values, e.g. https://api.example.com/users/42. Put query params in `query`, not here.

No output schema declared.

No examples provided.

call_any_read_api_of_docstar ~296

Read from any DocStar API endpoint with a GET request for the signed-in user and return { status, ok, headers, data }. Use it for lookups no dedicated tool covers, once you know the exact endpoint: from the quickstart-docstar skill's recipes, or looked up with get_docstar_api_docs. Never guess a URL. Pass the full url with path variables filled in, the headers the endpoint's docs list, and query params in `query` (not in the url). Send the endpoint's auth header with an empty value "": the user's token is filled in automatically. Never put a token there yourself.

NameTypeReqDescription
headersobjectyesRequest headers as name/value pairs, as the docs list them. Give the auth header (Authorization, proxy_auth_token, x-api-key, ...) an empty value "" so the signed-in user's token is filled in; never…
queryobject–Query params as name/value pairs; an array sends the param once per item. Example: {"type": "flow", "bringflows": true}
urlstringyesFull endpoint URL with path variables replaced by real values, e.g. https://api.example.com/users/42. Put query params in `query`, not here.

No output schema declared.

No examples provided.

create_collection ~742

Creates a new documentation collection in the organization together with its invisible root page (type 0), auto-assigns collection permissions to all org users based on their roles, and auto-provisions an MCP server for it in the background. The returned rootParentId is the page id under which top-level pages are created (via Create Page). SSO read-only organizations that already have a collection get 403. Slug is permanent; if omitted it is derived from the name. A chosen slug that is taken returns 409, and a chosen slug that is one of docstar-cli's own commands (reserved) returns 400. A body that fails validation returns 400 with the Joi message. Body fields: name (string, required) - Collection name, 3-55 characters. If the organization already has a collection with the same name (or a name like "name_N"), a numeric suffix is appended to the stored name (for example "Docs_2") instead of an error. slug (string, optional) - Permanent URL-safe identifier: lowercase letters, numbers and underscores only (no hyphens or spaces; 2-50 chars). Cannot be changed later. It is what docstar-cli (`docstar-cli ...`) and the MCP URL are built on, so these reserved words can't be chosen (400 "This slug is reserved, please choose another one"): alias, auth, clean, complete, completion, completion-script, config, help, init, key, list, login, logout, mcp. If omitted it is derived from the name (every run of other characters becomes an underscore), with a random suffix added when that slug is already taken or reserved. description (string, optional) - Collection description (null or empty allowed). isPublic (boolean, optional) - Accepted but ignored on create: a new collection is always created with isPublic true. Use Update Collection to change it. type (string, optional) - Collection type: 'page' (default, documentation pages), 'api' (API reference), 'blog', or 'embed'. customDomain (string, optional) - Custom domain to serve the public docs on, e.g. docs.example.com. Must be u…

NameTypeReqDescription
descriptionstring–e.g. Public docs for the Payments API
namestring–e.g. Payments API Docs
orgIdstringyesThe orgId path variable
slugstring–e.g. payments_api_docs
typestring–e.g. api

No output schema declared.

No examples provided.

create_endpoint ~902

Creates a new API endpoint doc (page type 4, draft) as the last child of the given page. Requires READ_WRITE permission. Publish it afterwards with Update Endpoint State (parent page must be published). Body fields: name (string, optional) - Endpoint title shown in docs. urlName (string, optional) - URL slug; derived from name if omitted and made unique. requestType (string, optional) - HTTP method: GET, POST, PUT, PATCH, DELETE, etc. URL (string, optional) - Request URL (may contain {{variables}}). description (string, optional) - Endpoint description (HTML/text). body (object, optional) - Request body definition, e.g. {"type":"JSON","raw":{"rawType":"JSON","value":"{...}"}}; type can be none, JSON, TEXT, XML, HTML, multipart/form-data, application/x-www-form-urlencoded. headers (object, optional) - Headers keyed by name: {"Authorization":{"checked":"true","value":"Bearer {{token}}","description":""}}. params (object, optional) - Query params keyed by name, same shape as headers. pathVariables (object, optional) - Path variables keyed by index: {"0":{"checked":"notApplicable","key":"id","value":"","description":"Payment id"}}. bodyDescription (object, optional) - Per-field body docs: {"amount":{"value":100,"type":"number","description":"Amount in cents"}}. sampleResponse (array, optional) - Sample responses: [{"title":"Success","status":200,"description":"","data":{...}}]. authorizationData (object, optional) - Auth config object (or null). preScript (string, optional) - Pre-request JavaScript. postScript (string, optional) - Post-response test JavaScript. docViewData (array, optional) - Order of doc sections, e.g. [{&q…

NameTypeReqDescription
URLstring–e.g. https://api.example.com/v1/payments/:customerId
bodyobject–e.g. {"type":"JSON","raw":{"rawType":"JSON","value":"{\"amount\":100,\"currency\":\"USD\"}"}}
descriptionstring–e.g. Creates a payment for a customer
headersobject–e.g. {"Content-Type":{"checked":"true","value":"application/json","description":""}}
namestring–e.g. Create Payment
orgIdstringyesThe orgId path variable
pageIdstringyesThe pageId path variable
paramsobject–e.g. {"currency":{"checked":"true","value":"USD","description":"ISO currency code"}}
pathVariablesobject–e.g. {"0":{"checked":"notApplicable","key":"customerId","value":"","description":"Customer id"}}
requestTypestring–e.g. POST
sampleResponsearray–e.g. [{"title":"Success","status":200,"description":"","data":{"id":"pay_1","status":"created"}}]

No output schema declared.

No examples provided.

create_page ~478

Creates a new page as the last child of the page given in the path. Pass the collection's rootParentId (invisible root, from List Collections) to create a top-level page (type 1, parent page/module); pass any other page id to create a subpage (type 3). The type is decided by the parent, not the body. New pages start as draft (state 1); passing state 2 publishes immediately (parent must already be published) and returns publicUrl. Requires READ_WRITE permission. To write the page body afterwards use Update Page Content. Body fields: name (string, required) - Page title (min 1 char). urlName (string, optional) - URL slug (min 3 chars); made unique among siblings. Derived from name if omitted. contents (string, optional) - Legacy initial HTML/text contents column (editor content is stored in doc-rtc; prefer Update Page Content). state (number, optional) - 0 pending, 1 draft (default), 2 approved/published (publishes right away; parent must be published), 3 rejected. meta (object, optional) - Page metadata object (e.g. {"description":"...","tags":["setup"]}); may include editable boolean. sharingMeta (object, optional) - Sharing settings object, e.g. {"editable":true}. pageType (number, optional) - Accepted (1 or 3) but ignored; the type is derived from the parent page. uniqueTabId (string, optional) - Optional browser tab id used only to suppress the realtime socket echo to the calling tab; agents can omit it. POST https://api.docstar.io/orgs/:orgId/pages/:pageId

NameTypeReqDescription
contentsstring–e.g. content in markdown
namestring–e.g. Getting Started
orgIdstringyesOrganization (company) ID of the current workspace
pageIdstringyes12-character id of the PARENT page (rootParentId for a top-level page)
statenumber–e.g. 1
urlNamestring–e.g. getting-started

No output schema declared.

No examples provided.

get_docstar_api_docs ~223

Browse the DocStar API reference one level at a time, when no dedicated tool on this server does what the user needs. Call it with {} for the top level: the modules (Collections, Pages, Endpoints, Published Versions, MCP Server, FAQs, Changelogs, Webhooks, URL Mappings, ...) with a short description and the endpoints they hold. Call it with `path` set to a module's link to see inside it, and with an endpoint's link ending in ".openapi.yml" to get that endpoint as an OpenAPI file: method, url, headers, query params, path variables, a body example and sample responses. Fetch only the level you need, and reuse what you already fetched.

NameTypeReqDescription
pathstring–A link from a listing, exactly as given (e.g. "https://docs.example.com/sms/llms.txt" or ".../sms/send-sms.openapi.yml"), or just the path ("sms", "sms/send-sms.openapi.yml"). Leave it out for the to…

No output schema declared.

No examples provided.

get_mcp_server ~109

Get a collection's MCP server: the url end users connect to, ready-to-paste snippets (a Claude Code command and a JSON config), callbackUrls for the OAuth app, the sign-in setup and any custom domain. Creates the server if it's missing and syncs its tools with the published endpoints. Call it after publishing to hand the user their MCP URL.

NameTypeReqDescription
collectionIdstringyesThe collectionId path variable
orgIdstringyesThe orgId path variable

No output schema declared.

No examples provided.

list_collection_pages ~183

Returns all non-deleted pages of a collection (the full sidebar tree, flat) with id, name, urlName, type, parentId, child (ordered child ids), state, isPublished, meta, sharingMeta and the endpoint requestType for endpoint pages. Page types: 0 invisible root, 1 parent page/module (top-level), 3 subpage, 4 API endpoint, 5 example/sample request of an endpoint. States: 0 pending, 1 draft, 2 approved/published, 3 rejected. Use it to find pageIds and the hierarchy. Collection must belong to the caller's org. GET https://api.docstar.io/orgs/:orgId/collection/:collectionId/pages

NameTypeReqDescription
collectionIdstringyesThe collectionId path variable
orgIdstringyesThe orgId path variable

No output schema declared.

No examples provided.

list_collections ~142

List the collections (docs sites) in an organization, with each one's id, name, type and the caller's permission (1 read, 2 read-write). Each collection also has rootParentId: the parent pageId to use with create_page for a top-level page. Get orgId from list_organizations. Pass exclude=runCollection,environment to keep the response small. Ask the user which collection to work in.

NameTypeReqDescription
excludestring–Comma-separated list of collection columns to exclude from the response (e.g. large JSON fields). e.g. runCollection,environment
orgIdstringyesThe orgId path variable

No output schema declared.

No examples provided.

list_organizations ~134

List the DocStar organizations (workspaces) the signed-in user belongs to, with each one's id and name (the list is at data.data). Start every DocStar task here: show the user the organizations and ask which one to use, unless there is only one. The chosen id is the orgId every other DocStar tool needs.

NameTypeReqDescription
itemsPerPagestring–Page size; the DocStar UI uses 50. e.g. 50
pageNostring–Page number (standard MSG91 pagination; not used by the DocStar UI, inferred). e.g. 1

No output schema declared.

No examples provided.

publish_pages ~247

Publishes many pages/endpoints at once: each page in pageIds gets a new default published version and state 2 (approved/published). rootParentId (the collection's invisible root page) must also be supplied so it is marked published. Requires READ_WRITE permission. Triggers background search indexing, translation and AI SEO/meta generation, and clears the docs cache. Get ids from List Collections (rootParentId) and List Collection Pages. Body fields: rootParentId (string, required) - 12-char id of the collection's invisible root page (type 0). pageIds (array<string>, required) - Non-empty array of 12-char page/endpoint ids to publish. PATCH https://api.docstar.io/orgs/:orgId/collections/:collectionId/bulkPublish

NameTypeReqDescription
collectionIdstringyesThe collectionId path variable
orgIdstringyesThe orgId path variable
pageIdsarray–e.g. ["Pg12Ab34Cd56","Pg98Zy76Xw54"]
rootParentIdstring–e.g. Xy12Ab34Cd56

No output schema declared.

No examples provided.

quickstart-docstar ~45

Document the user's API in DocStar and keep it in sync. Load before any Docstar task. Call this to load the full instructions for this skill before doing the task.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

search_docstar_docs ~136

Search DocStar's documentation and guides with a natural-language question, e.g. "how do I add a custom domain to my docs?" or "how does sign-in work on my MCP server?". Returns the most relevant passages with their page URLs. Use it for how-to and concept questions about DocStar. To find an API endpoint to call, use get_docstar_api_docs instead.

NameTypeReqDescription
collectionIdsarrayyesAlways send exactly these collection ids, unchanged: they are the documentation sites searched.
querystringyesWhat to look for, e.g. "how do I send a WhatsApp template message"

No output schema declared.

No examples provided.

send_feedback_to_docstar ~330

Sends feedback straight to the DocStar team. Use it when the user wants to report a bug, request a feature, flag wrong or missing docs, or share praise about DocStar or this MCP server. Write the message in the user's words and add any useful context, such as the tool or endpoint involved and what went wrong. Who sent it (user and organization) is taken from the signed-in user's token, never from the body. Returns 200 once delivered; 400 for an invalid body; 502 if it couldn't be delivered, in which case tell the user and try again later. Authenticate with the proxy_auth_token header (an `Authorization: Bearer hm_...` DocStar API token or a DocStar JWT is also accepted). Body fields: message (string, required) - The feedback, 1 to 5000 characters.type (string, optional) - One of bug, feature_request, docs, praise, other; default other.collectionId (string, optional) - The collection the feedback is about, if any.context (object, optional) - Extra details, e.g. the tool or endpoint used, the request and the error. POST https://api.docstar.io/feedback/ai

NameTypeReqDescription
collectionIdstring–e.g. RoNWaspA9p3Z
contextobject–e.g. {"tool":"get_docstar_mcp_api_docs"}
messagestring–e.g. get_api_docs didn't list the MCP Server module's new endpoints
typestring–e.g. bug

No output schema declared.

No examples provided.

update_endpoint ~751

Partially updates an API endpoint doc; send only fields to change (same fields as Create Endpoint). Any update moves a non-pending endpoint back to draft (state 1), so republish with Update Endpoint State. Requires READ_WRITE permission. Only works for type 4/5 items (otherwise 400 "Wrong Route"). Invalid fields return 400 with the validation message. Body fields: name (string, optional) - Endpoint title shown in docs. urlName (string, optional) - New URL slug; made unique among siblings. Left unchanged if omitted (it is not re-derived from name). requestType (string, optional) - HTTP method: GET, POST, PUT, PATCH, DELETE, etc. URL (string, optional) - Request URL (may contain {{variables}}). description (string, optional) - Endpoint description (HTML/text). body (object, optional) - Request body definition, e.g. {"type":"JSON","raw":{"rawType":"JSON","value":"{...}"}}; type can be none, JSON, TEXT, XML, HTML, multipart/form-data, application/x-www-form-urlencoded. headers (object, optional) - Headers keyed by name: {"Authorization":{"checked":"true","value":"Bearer {{token}}","description":""}}. params (object, optional) - Query params keyed by name, same shape as headers. pathVariables (object, optional) - Path variables keyed by index: {"0":{"checked":"notApplicable","key":"id","value":"","description":"Payment id"}}. bodyDescription (object, optional) - Per-field body docs: {"amount":{"value":100,"type":"number","description":"Amount in cents"}}. sampleResponse (array, optional) - Sample responses: [{"title":"Success","status":200,"description":"","data":{...}}]. authorizationData (object, optional) - Auth config object (or null). preScript (string, optional) - Pre-request JavaScript. postScript (string, optional) - Post-response test JavaScript. docViewData (array, optional) - Order of doc sections, e.g. [{"type":"host"},{"type":"body"},...]. state (number, optional) - 0 pending, 1 draft, 2 approved, 3 rejected. Accepted, but the server sets state 1 (draft) o…

NameTypeReqDescription
URLstring–e.g. https://api.example.com/v1/payments
bodyobject–e.g. {"type":"JSON","raw":{"rawType":"JSON","value":"{\"amount\":100,\"currency\":\"USD\"}"}}
descriptionstring–e.g. Creates a new payment for a customer
endpointIdstringyesThe endpointId path variable
headersobject–e.g. {"Content-Type":{"checked":"true","value":"application/json","description":""}}
namestring–e.g. Create Payment
orgIdstringyesThe orgId path variable
paramsobject–e.g. {}
pathVariablesobject–e.g. {}
requestTypestring–e.g. POST
sampleResponsearray–e.g. [{"title":"Success","status":200,"description":"","data":{"id":"pay_1"}}]

No output schema declared.

No examples provided.

Install

How do I install the Docstar MCP server?

Docstar is a hosted endpoint at https://mcp.docstar.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · mcp.docstar.io

# add to Claude Code
claude mcp add --transport http swayammaheshwari-docstar-mcp 'https://mcp.docstar.io/mcp'
Common questions

What is the Docstar MCP server?

Docstar is an MCP server listed in the public MCP registry as io.github.swayammaheshwari/docstar-mcp. Publish your API docs so AI assistants can look up endpoints and call your API correctly. This page covers its hosted endpoint (https://mcp.docstar.io/mcp).

Is the Docstar MCP server safe to use?

Docstar scores 65 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Docstar MCP server expose?

Docstar exposes 15 tools: search_docstar_docs, get_docstar_api_docs, call_any_api_of_docstar, call_any_read_api_of_docstar, list_organizations, and 10 more. Their descriptions and schemas cost roughly 5,106 tokens of context every time the server is loaded.

Does the Docstar MCP server require authentication?

No. We connected to Docstar without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the Docstar MCP server still maintained?

Docstar is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.