Arcade.fun
REMOTE · ARCADE.FUN
Discover playable browser experiences and manage creator-owned game uploads on Arcade.fun.
Available components
Last scanned (3 hours ago)
Scores higher than 57% of remote servers
Reachable. Last reached 5 Nov 2026.
Category Entertainment and Games
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security80
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability61
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 1187 tokens (~148/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management17
- Stability observed for 5 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage92
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 76% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Nov 26 +1
- “create_experience” added an optional parameter “releaseNotes” cosmetic
- “start_version” added an optional parameter “releaseNotes” cosmetic
2 cosmetic changes on this day. Switch on “Show cosmetic changes” to see them.
- 1 Nov 26 0
- Stability: unverified → 0.03 ▲ functional
- 31 Oct 26 69
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://arcade.fun/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=arcade.fun | CN=YE2,O=Let's Encrypt,C=US | 25 Oct 2026 | 23 Jan 2027 | ECDSA 256 | ECDSA-SHA384 | 51f2d5a3353c9a9856279e48c62867c69e1 |
| SANs: arcade.fun | ||||||
| CN=YE2,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 4df3b15dd6c0784c507cd37b58e6f115 |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of arcade.fun. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| fun. | present | 47728 | 13 | Verified |
| arcade.fun. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains |
| x-content-type-options | nosniff |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(self "https://games.rcade.fun" "https://mask.games.rcade.fun" "https://chop.games.rcade.fun" "https://robot.games.rcade.fun" "https://math.games.rcade.fun" "https://munch.games.rcade.fun" "https://pilot.games.rcade.fun" "https://point.games.rcade.fun" "https://dragon.games.rcade.fun" "https://captain.games.rcade.fun" "https://pong.games.rcade.fun" "https://lantern-keeper.games.rcade.fun" "https://glacier-glide.games.rcade.fun" "https://aurora-weave.games.rcade.fun"), microphone=(self "https://games.rcade.fun"), fullscreen=(self "https://games.rcade.fun" "https://cloudpost-courier.games.rcade.fun" "https://starling-salvage.games.rcade.fun" "https://noodle-circuit.games.rcade.fun" "https://prism-arena.games.rcade.fun" "https://signal-loom.games.rcade.fun" "https://pocket-planet.games.rcade.fun" "https://fraction-foundry.games.rcade.fun" "https://online-checkers.games.rcade.fun" "https://online-hex.games.rcade.fun" "https://online-boxes.games.rcade.fun" "https://online-mancala.games.rcade.fun" "https://o |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://arcade.fun/mcp | Verified | 200 | |
| http (plaintext) | http://arcade.fun/mcp | HTTPS enforced | 301 | https://arcade.fun/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
create_experience Create an experience ~305
Register a new experience and get its manage key. Returns game, key and the first version id. The key is shown only here and controls the listing forever — save it. This creates a draft; upload_build is what sends it for review.
| Name | Type | Req | Description |
|---|---|---|---|
| aspect | string | – | Shape on screen. Empty fills the screen. |
| author | string | yes | The creator name players see, 2 to 30 characters. |
| devices | array | – | Devices actually tested. Mobile requires touch, voice or camera among inputs. |
| string | yes | Reviewer contact address. Players never see it. | |
| how | string | – | How to take part: the controls and how to begin. |
| inputs | array | yes | How people interact. At least one. |
| kind | string | – | 'sdk' if the entry page calls arcade.ready(), otherwise 'web'. Detected from the build too. |
| releaseNotes | object | – | Public changelog notes, shown only after this build is approved. |
| rights | boolean | yes | Confirm the experience is yours to share, including its art, music and code. |
| tagline | string | – | One line for the cabinet. |
| terms | boolean | yes | Confirm you agree to the arcade.fun terms and community guidelines. |
| title | string | yes | What the experience is called, 2 to 60 characters. |
| wallet | string | yes | Solana address that receives this listing's creator trading fees. Every public listing launches with its own coin. |
No output schema declared.
No examples provided.
experience_status Check an experience ~47
Where an experience stands: its details, its coin plan, any note from the reviewers, and every version with its status.
| Name | Type | Req | Description |
|---|---|---|---|
| game | string | yes | – |
| key | string | yes | – |
No output schema declared.
No examples provided.
list_experiences List the Community shelf ~31
Every approved experience currently playable on arcade.fun, with the origin games are served from. Needs no credentials.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
set_cover Set the cover art ~68
Upload the square cover used for the cabinet, the sharing card and the coin image. PNG, JPEG, WebP or GIF up to 4 MB.
| Name | Type | Req | Description |
|---|---|---|---|
| game | string | yes | – |
| image_base64 | string | yes | The image, base64 encoded. |
| key | string | yes | – |
No output schema declared.
No examples provided.
set_entry Choose the start page ~60
Name the page that starts the experience, when a zip had several and no index.html.
| Name | Type | Req | Description |
|---|---|---|---|
| entry | string | yes | A path the upload result offered, e.g. game/play.html. |
| key | string | yes | – |
| version | string | yes | – |
No output schema declared.
No examples provided.
set_trailer Set the trailer ~66
Upload the MP4 played when the experience's link is shared. Without one the platform builds an animated title card from the cover instead.
| Name | Type | Req | Description |
|---|---|---|---|
| game | string | yes | – |
| key | string | yes | – |
| video_base64 | string | yes | The MP4, base64 encoded. |
No output schema declared.
No examples provided.
start_version Start a new version ~77
Open a new version slot for an experience you already own. The live approved version keeps playing until the new one is reviewed.
| Name | Type | Req | Description |
|---|---|---|---|
| game | string | yes | The 12-character game id. |
| key | string | yes | That game's manage key. |
| releaseNotes | object | – | Public changelog notes, shown only after this build is approved. |
No output schema declared.
No examples provided.
upload_build Upload a build ~267
Send the browser build for a version and publish it. One HTML file, or a zip with index.html at its root. A build that passes the sandbox checks goes live immediately: the result has `live: true` and the play URL. Otherwise `live: false` and `waiting` says why, either a list of things to fix or that this arcade reviews that upload by hand. Also returns file count, size, engine and whether the arcade SDK was detected. If the zip has several pages and no index.html, the result asks which page starts it — answer with set_entry.
| Name | Type | Req | Description |
|---|---|---|---|
| content_base64 | string | yes | The .html or .zip file, base64 encoded. Up to 24 MB decoded. |
| entry | string | – | Start page inside a zip, if it is not index.html. |
| filename | string | yes | The file's name, so the type is read correctly: e.g. index.html or build.zip. |
| key | string | yes | The game's manage key. |
| threads | boolean | – | True if the build needs SharedArrayBuffer. Threaded builds open in their own tab and cannot use the SDK bridge. Omit to work it out from the files. |
| version | string | yes | Version id from create_experience or start_version. |
No output schema declared.
No examples provided.
How do I install the Arcade.fun MCP server?
Arcade.fun is a hosted endpoint at https://arcade.fun/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · arcade.fun
claude mcp add --transport http theguysaccount-arcade-fun 'https://arcade.fun/mcp'
What is the Arcade.fun MCP server?
Arcade.fun is an MCP server listed in the public MCP registry as io.github.theguysaccount/arcade-fun. Discover playable browser experiences and manage creator-owned game uploads on Arcade.fun. This page covers its hosted endpoint (https://arcade.fun/mcp).
Is the Arcade.fun MCP server safe to use?
Arcade.fun scores 71 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Arcade.fun MCP server expose?
Arcade.fun exposes 8 tools: list_experiences, create_experience, start_version, upload_build, set_entry, and 3 more. Their descriptions and schemas cost roughly 921 tokens of context every time the server is loaded.
Does the Arcade.fun MCP server require authentication?
No. We connected to Arcade.fun without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Arcade.fun MCP server still maintained?
Arcade.fun is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.