# spawnpop (remote · spawnpop.com)

Roblox game assets for your agent: free kit plan, then GUI, icons, thumbnails, 3D props and music.

- Trust score: 76/100 (medium)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `spawnpop.com`: 76/100 (this document), [markdown](https://verifymcp.io/servers/tinbox-labs-spawnpop/spawnpop.md), [page](https://verifymcp.io/servers/tinbox-labs-spawnpop/spawnpop)

## Channel facts

- Endpoint: `https://spawnpop.com/mcp`
- Transports: `streamable-http`
- Auth: `required (not validated)`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 83/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation is enforced on tool calls, but the challenge carries no valid RFC 9728 metadata, so a client cannot discover where to get a token.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 60/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 1774 tokens (~136/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 40/100
  - Stability observed for 12 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 76/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 29% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 13 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 14 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the spawnpop MCP server?

spawnpop is a hosted endpoint at https://spawnpop.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http tinbox-labs-spawnpop 'https://spawnpop.com/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "tinbox-labs-spawnpop": {
      "url": "https://spawnpop.com/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "tinbox-labs-spawnpop": {
      "type": "http",
      "url": "https://spawnpop.com/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.tinbox-labs-spawnpop]
url = "https://spawnpop.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "tinbox-labs-spawnpop": {
      "type": "remote",
      "url": "https://spawnpop.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add tinbox-labs-spawnpop --url 'https://spawnpop.com/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  tinbox-labs-spawnpop:
    url: "https://spawnpop.com/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "tinbox-labs-spawnpop": {
      "Transport": "http",
      "Url": "https://spawnpop.com/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add tinbox-labs-spawnpop -t streamable-http -u 'https://spawnpop.com/mcp'
```

### Other

```json
{
  "mcpServers": {
    "tinbox-labs-spawnpop": {
      "type": "http",
      "url": "https://spawnpop.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 76, +1)

No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-03 (score 75, +1)

No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-01 (score 74, +1)

- [security] Tool “generate” rewrote its description, which is the text the model reads

### 2026-10-31 (score 73, 0)

- [security] The server rewrote its instructions, which are the text every model session reads
- [functional regression] Schema quality: 1201 → 1737
- [functional improvement] Tool coverage: 22% → 29%
- [functional] New tool “asset_kit”
- [functional] New tool “game_concept”
- [functional] New tool “get_spec”
- [functional] New tool “update_state”
- [cosmetic] “generate” reworded the description of “options”

### 2026-10-30 (score 73, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-29 (score 72, 0)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “draft” rewrote its description, which is the text the model reads
- [security] Tool “generate_sprite_sheet” rewrote its description, which is the text the model reads

### 2026-10-28 (score 72, +1)

No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-27 (score 71, 0)

- [security] The server rewrote its instructions, which are the text every model session reads
- [functional regression] Schema quality: 119 → 133
- [functional improvement] Tool coverage: 16% → 22%
- [functional] New tool “generate_sprite_sheet”
- [functional] New tool “get_sprite_status”

## MCP tools (13)

### `plan_kit` (~105 tokens)

Plan a Roblox asset kit

No charge. Turns a one-sentence game idea into a priced kit (GUI, icons, thumbnail, 3D props, music). With an API key the plan is saved as a project; without one you get the same plan and price plus a link for the user to connect.

Input parameters:

- `description` (string, required): The game idea in plain words.
- `genre` (string)
- `style` (string): Art direction, e.g. "chunky pastel cartoon".

### `draft` (~90 tokens)

Draft items cheaply

Costs 13 credits per draft image. Makes low-cost previews with an AI fit check so finals are only bought for what works. confirmCredits must equal the price (items x copies x variants); requestId makes a retry free.

Input parameters:

- `confirmCredits` (integer, required)
- `itemIds` (array, required)
- `projectId` (string, required)
- `requestId` (string, required)
- `variants`

### `approve` (~49 tokens)

Approve drafts

No charge. Marks one draft per item copy as the reference its final is made from. Use the outputId shown by get_status.

Input parameters:

- `approvals` (array, required)
- `projectId` (string, required)

### `generate` (~142 tokens)

Generate final assets

Spends credits. confirmCredits must equal the price of the items; if the price changed nothing is charged and price_changed comes back. Credits paid for an item's draft count toward that item's final (draft + final = the quoted price): confirming the plan_kit price is accepted and only the lower remaining price is charged. The same requestId returns the same jobs and charges nothing. itemIds may be "approved".

Input parameters:

- `confirmCredits` (integer, required)
- `itemIds` (required)
- `options` (object): iconStyle: the game icon look when plan_kit listed styles.gameIcon.
- `projectId` (string, required)
- `requestId` (string, required)

### `get_status` (~86 tokens)

Project status

No charge. One row per plan item, drafts with the AI fit verdict (fit, misfit, unjudged or pending; unjudged never blocks approve), approvals and balance. waitSeconds (0-25) returns as soon as something changes, so a call can come back earlier than that.

Input parameters:

- `projectId` (string, required)
- `waitSeconds` (integer)

### `get_files` (~50 tokens)

Finished files

No charge. Finished files with one-hour signed download URLs, sizes, triangle counts and stud sizes, plus a ready next-step block for Roblox Studio MCP and Open Cloud.

Input parameters:

- `projectId` (string, required)

### `list_projects` (~25 tokens)

List projects

No charge. Your recent projects, newest first.

Input parameters:

- `limit` (integer)

### `generate_sprite_sheet` (~212 tokens)

Generate a game sprite sheet

Spends credits (180, plus 50 for each extra animation, at most 2). Draws one character from a description in a chosen style with idle, run and attack animations and delivers the sheet, GIFs, frames and JSON via get_sprite_status. confirmCredits must equal the price; the same requestId returns the same order and charges nothing. Only one paid sprite order is open per account at a time. Without an API key nothing is spent: you get the price and links for the user.

Input parameters:

- `confirmCredits` (integer): The exact price you showed the user. Required with an API key.
- `description` (string, required)
- `extras` (array)
- `fromRunId` (string): A finished web preview of the same character: keeps its character and idle sheet, so only the rest is drawn.
- `requestId` (string): Required with an API key. A new one for each new purchase, the same one to retry.
- `style` (string, required)

### `get_sprite_status` (~91 tokens)

Sprite sheet status

No charge. Progress of a sprite sheet order. When it is done: signed one-hour download links for the sprite sheet PNG, one GIF per animation, a frames zip, the sheet JSON and the character. waitSeconds (0-25) returns as soon as something changes, so a call can come back earlier than that.

Input parameters:

- `runId` (string, required)
- `waitSeconds` (integer)

### `game_concept` (~226 tokens)

Write a game spec from an idea

No charge. Turns a genre preset, an art-style preset and a one-line idea into a short game spec your coding agent can build from: intent (frozen), plan (milestones with testable done_when, playtest, asset manifest) and state (you update it with update_state). Returns game_spec.json plus GAME_SPEC.md, AGENTS.md and PROMPT.md to save in the project. Names of existing games, characters and brands are removed: specs are original games only. With an API key the spec is saved (specId) for get_spec, update_state and asset_kit.

Input parameters:

- `artStyle` (string, required)
- `genre` (string, required): obby | simulator (also tycoon) | survivors (horde) | cozy (one-verb 3D toy) | rpg | voxel (city builder) | coop (two players)
- `idea` (string, required): One sentence in your own words. No "like <existing game>".
- `target` (string): roblox, or web (a single-page three.js game)

### `get_spec` (~42 tokens)

Read a saved game spec

No charge. The saved spec (all three layers) and its handoff files. Without specId, lists your recent specs.

Input parameters:

- `specId` (string)

### `update_state` (~88 tokens)

Record build progress

No charge. Updates ONLY the STATE layer of a saved spec: milestone_status ({milestoneId: todo|doing|done|blocked}), built (lines appended) and notes (appended). The intent and the plan cannot be changed here; if the intent looks wrong, ask the human.

Input parameters:

- `patch` (required): { milestone_status?, built?, notes? }
- `specId` (string, required)

### `asset_kit` (~105 tokens)

Quote the matching asset kit

No charge here. Plans the assets a saved spec needs (GUI set with its finished screen, icons, thumbnail, props, music) in the spec's style and returns one total in credits plus a kit projectId. Show the user the total; then draft/approve/generate on that projectId exactly as after plan_kit (generate takes confirmCredits). The kit zip includes the spec files. Calling it again returns the same project.

Input parameters:

- `specId` (string, required)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/tinbox-labs-spawnpop/spawnpop#diagnostics

## Score history

- 2026-11-05: 76
- 2026-11-04: 75
- 2026-11-03: 75
- 2026-11-02: 74
- 2026-11-01: 74
- 2026-10-31: 73
- 2026-10-30: 73
- 2026-10-29: 72
- 2026-10-28: 72
- 2026-10-27: 71
- 2026-10-26: 71
- 2026-10-25: 71
- 2026-10-24: 70

## Common questions

### What is the spawnpop MCP server?

spawnpop is an MCP server listed in the public MCP registry as io.github.tinbox-labs/spawnpop. Roblox game assets for your agent: free kit plan, then GUI, icons, thumbnails, 3D props and music. This page covers its hosted endpoint (https://spawnpop.com/mcp).

### Is the spawnpop MCP server safe to use?

spawnpop scores 76 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the spawnpop MCP server expose?

spawnpop exposes 13 tools: plan_kit, draft, approve, generate, get_status, and 8 more. Their descriptions and schemas cost roughly 1,311 tokens of context every time the server is loaded.

### Does the spawnpop MCP server require authentication?

Yes. spawnpop asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

### Is the spawnpop MCP server still maintained?

spawnpop is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://spawnpop.com/mcp
- Website: https://spawnpop.com/mcp
- Changelog RSS feed: https://verifymcp.io/servers/tinbox-labs-spawnpop/spawnpop.xml
- Changelog JSON feed: https://verifymcp.io/servers/tinbox-labs-spawnpop/spawnpop.json
- HTML version of this page: https://verifymcp.io/servers/tinbox-labs-spawnpop/spawnpop