Velox TriFit: Virtual Try-On API
REMOTE · STUDIO.V3LOX.COM
Virtual try-on (VTO) API docs and SDK examples; OAuth account/guest photo uploads and try-ons.
Available components
Last scanned (2 hours ago)
Scores higher than 44% of remote servers
Reachable. Last reached 5 Nov 2026.
Category AI and Machine Learning
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security57
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (create_trifit_try_on). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability43
- 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Fail
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 1793 tokens (~89/item across 20 items; 18 tools + 2 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management40
- Stability observed for 12 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage74
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 10% of tool parameters carry a description.Partial
- Structured output schemas are declared (94% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 18 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 20 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
- Supports UI / widget rendering.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.
- 31 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.
- 29 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
- 27 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 25 Oct 26 +1
- Stability: unverified → 0.03 ▲ functional
- 24 Oct 26 56
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://studio.v3lox.com/partner/trifit/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_256_GCM_SHA384 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=studio.v3lox.com | CN=GeoTrust TLS RSA CA G1,OU=www.digicert.com,O=DigiCert Inc,C=US | 2 Sept 2026 | 2 Mar 2027 | RSA 2048 | SHA256-RSA | f2279334f522e2dc745bbb968e7799a |
| SANs: studio.v3lox.com | ||||||
| CN=GeoTrust TLS RSA CA G1,OU=www.digicert.com,O=DigiCert Inc,C=US (CA) | CN=DigiCert Global Root G2,OU=www.digicert.com,O=DigiCert Inc,C=US | 2 Nov 2017 | 2 Nov 2027 | RSA 2048 | SHA256-RSA | d07782a133fc6f9a57296e131ffd179 |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of studio.v3lox.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| v3lox.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| x-content-type-options | nosniff |
| referrer-policy | no-referrer |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://studio.v3lox.com/partner/trifit/mcp | Verified | 200 | |
| http (plaintext) | http://studio.v3lox.com/partner/trifit/mcp | HTTPS enforced | 301 | https://studio.v3lox.com/partner/trifit/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
create_trifit_try_on Create a TriFit account try-on ~126
Only after explicit user approval, submit one DressMe request using two existing account image IDs. Uses the website queue and existing account allowance, not the guest demo. The attempt can consume allowance. Never automatically retry, replace the request ID or claim that a timeout means it did not run. Check the original receipt.
| Name | Type | Req | Description |
|---|---|---|---|
| permissionConfirmed | boolean | yes | – |
| personalAssetId | string | yes | – |
| productAssetId | string | yes | – |
| requestId | string | yes | New stable UUID for this approved request. Do not change it or replay after an uncertain response. |
| Name | Type | Req | Description |
|---|---|---|---|
| acceptanceUnknown | boolean | yes | – |
| createdAt | string | – | – |
| elapsedSeconds | number | – | – |
| environment | string | yes | – |
| jobId | string | – | – |
| message | string | – | – |
| progressPercent | number | – | – |
| quotaSource | string | yes | – |
| requestId | string | – | – |
| resultAssetId | string | – | – |
| retryAllowed | boolean | yes | – |
| status | string | yes | – |
| timing | object | – | – |
| updatedAt | string | – | – |
No examples provided.
create_try_on Create one guest virtual try-on ~148
Generate a DressMe virtual try-on from the user’s personal photo and clothing reference only after their explicit request and permission. In ChatGPT pass both attached image files; in Codex pass the two asset IDs returned by completed private uploads. Use one method, not both. Consumes one session attempt and one shared daily attempt. One attempt per guest session, ten per day across all guests. Do not automatically retry or bypass limits. Returns a receipt; get_try_on retrieves its status/result.
| Name | Type | Req | Description |
|---|---|---|---|
| consent | boolean | yes | – |
| garment_image | object | – | – |
| personal_asset_id | string | – | – |
| personal_image | object | – | – |
| product_asset_id | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| createdAt | string | yes | – |
| durationSeconds | number | – | – |
| error | string | – | – |
| failureCode | string | – | – |
| failureHttpStatus | number | – | – |
| failureStage | string | – | – |
| jobId | string | – | – |
| minimumStartGapSeconds | number | – | – |
| queuePaused | boolean | – | – |
| queuePosition | number|null | – | – |
| requestId | string | yes | – |
| resultAssetId | string | – | – |
| status | string | yes | – |
| submissionAttempted | boolean | – | – |
| timing | object | – | – |
| updatedAt | string | yes | – |
No examples provided.
fetch Read a Velox developer document ~45
Read the full public document for an ID returned by search, with an official source URL and deployed content checksum. Does not fetch arbitrary URLs or private files.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
| sha256 | string | yes | – |
| text | string | yes | – |
| title | string | yes | – |
| url | string | yes | – |
No examples provided.
get_guest_demo_status Check guest try-on allowance ~32
Read the current private guest-session allowance and its perSessionLimit denominator. Does not upload images or generate anything.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| busy | boolean | yes | – |
| dailyLimit | number | yes | – |
| environment | string | yes | – |
| minimumStartGapSeconds | number | yes | – |
| perSessionLimit | number | yes | – |
| queueMode | string | – | – |
| queuePaused | boolean | – | – |
| remainingToday | number | yes | – |
| requestId | string|null | yes | – |
| sessionExpiresAt | string | yes | – |
| sessionRemaining | number | yes | – |
| timeZone | string | yes | – |
No examples provided.
get_integration_example Get a Velox SDK integration example ~57
Retrieve the runnable offline JavaScript/Node.js integration example or accompanying TypeScript declarations. Other language SDKs are not released. The example uses dummy local responses, with no cloud calls or generation charges.
| Name | Type | Req | Description |
|---|---|---|---|
| language | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| declarations | object | – | – |
| example | object | yes | – |
| language | string | yes | – |
| productionGuidance | object | yes | – |
| repository | string | yes | – |
| setup | array | yes | – |
| simulated | boolean | yes | – |
No examples provided.
get_partner_access_requirements Get Velox partner access requirements ~52
Explain how to apply for manually provisioned Velox Partner API access and keep the scoped application key on a backend. Does not create accounts, issue keys, send an application or promise a universal free allowance.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| allowance | string | yes | – |
| applicationTopic | string | yes | – |
| applicationUrl | string | yes | – |
| credentials | string | yes | – |
| provisioning | string | yes | – |
| sdkReference | string | yes | – |
| shopperAuthentication | string | yes | – |
| source | object | yes | – |
No examples provided.
get_partner_application_guide Apply to the TriFit team through your connected mailbox ~77
Read the official in-chat Partner API application workflow: partner@v3lox.com, sender confirmation, optional project details, draft preview, send approval and actual reply verification. Public guidance only; this tool does not send email, inspect a mailbox, submit a form, issue keys or change access. No TriFit account is required.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_trifit_account Read your connected TriFit profile ~46
Identify whether this verified connection is a guest session or a personal TriFit account before choosing tools. Does not link, switch, create an account or trust a conversational email hint.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| environment | string | yes | – |
| id | string | yes | – |
| name | string | yes | – |
| quotaSource | string | yes | – |
No examples provided.
get_trifit_allowance Read your TriFit account allowance ~36
Read the same daily, weekly and monthly allowances as the TriFit website. Does not create, reset or spend credits.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| checkedAt | string | yes | – |
| environment | string | yes | – |
| quotaSource | string | yes | – |
| stages | array | yes | – |
No examples provided.
get_trifit_profile Identify your connected TriFit profile ~43
Read the stable profile represented by this connection. No account creation, switching, uploads or generation. Use get_trifit_account for connection mode and allowance source.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
| name | string | yes | – |
| nickname | string | yes | – |
No examples provided.
get_trifit_try_on Read an existing TriFit request ~64
Read the status, recorded duration and result ID of an existing account DressMe request without generating or replaying. A missing receipt means acceptance is uncertain, not that it never ran.
| Name | Type | Req | Description |
|---|---|---|---|
| jobId | string | – | – |
| requestId | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| acceptanceUnknown | boolean | yes | – |
| createdAt | string | – | – |
| elapsedSeconds | number | – | – |
| environment | string | yes | – |
| jobId | string | – | – |
| message | string | – | – |
| progressPercent | number | – | – |
| quotaSource | string | yes | – |
| requestId | string | – | – |
| resultAssetId | string | – | – |
| retryAllowed | boolean | yes | – |
| status | string | yes | – |
| timing | object | – | – |
| updatedAt | string | – | – |
No examples provided.
get_try_on Read your guest try-on result ~90
Read only an existing request belonging to this authenticated guest session. With include_image=true, shows the completed image in a result card in ChatGPT and an inline image in other MCP clients. Does not create/retry a generation. Poll no more often than once every five seconds. A needs_review result must not be replayed.
| Name | Type | Req | Description |
|---|---|---|---|
| include_image | boolean | – | – |
| request_id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| createdAt | string | yes | – |
| durationSeconds | number | – | – |
| error | string | – | – |
| failureCode | string | – | – |
| failureHttpStatus | number | – | – |
| failureStage | string | – | – |
| jobId | string | – | – |
| minimumStartGapSeconds | number | – | – |
| queuePaused | boolean | – | – |
| queuePosition | number|null | – | – |
| requestId | string | yes | – |
| resultAssetId | string | – | – |
| status | string | yes | – |
| submissionAttempted | boolean | – | – |
| timing | object | – | – |
| updatedAt | string | yes | – |
No examples provided.
list_trifit_library List your TriFit account history ~56
Read metadata for your saved personal photos, products, looks and DressMe requests. No image bytes or guest history transfer.
| Name | Type | Req | Description |
|---|---|---|---|
| kind | string | – | – |
| limit | integer | – | – |
| offset | integer | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| environment | string | yes | – |
| items | array | yes | – |
| librarySource | string | yes | – |
| nextOffset | – | yes | – |
| total | integer | yes | – |
No examples provided.
prepare_guest_upload Prepare a private local image upload ~83
For Codex/local files: reserve one single-use HTTPS PUT upload for a personal photo or product image. Upload the user-selected file bytes to the returned URL; do not disclose that capability. Server resizes JPEG, PNG or WebP automatically. At most one upload per role per guest session. This does not generate a try-on.
| Name | Type | Req | Description |
|---|---|---|---|
| role | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| expiresInSeconds | number | yes | – |
| maxBytes | number | yes | – |
| method | string | yes | – |
| role | string | yes | – |
| uploadUrl | string | yes | – |
No examples provided.
prepare_trifit_upload Prepare a local photo upload to TriFit ~165
For a user-selected local file in Codex, with explicit permission: create a private, one-use upload URL valid for at most five minutes. PUT only that JPEG/PNG/WebP file as raw bytes, with its image Content-Type, no API/OAuth headers and no redirects. Do not print or share the URL. The PUT saves/resizes the image in the connected account library and selects its website photo/product slot; product images use cached description preparation. Preserve clientImportId and the returned assetId. Never retry an uncertain upload automatically. Preparing does not upload or generate.
| Name | Type | Req | Description |
|---|---|---|---|
| clientImportId | string | yes | Stable UUID for this user-approved import. Never replace after an uncertain upload. |
| permissionConfirmed | boolean | yes | – |
| role | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| clientImportId | string | yes | – |
| environment | string | yes | – |
| expiresAt | string | yes | – |
| maxBytes | integer | yes | – |
| method | string | yes | – |
| role | string | yes | – |
| uploadUrl | string | yes | – |
No examples provided.
search Search Velox developer documentation ~46
Find official Velox DressMe virtual try-on integration documentation, authentication, SDK languages, upload, polling and recovery guidance. Searches only the deployed public documentation corpus.
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| results | array | yes | – |
No examples provided.
show_trifit_try_on Show an existing TriFit result ~64
Show a completed account DressMe image inside the conversation. Requires separate private-image permission. Uses only the existing result; no generation, upload, public share or new allowance is used.
| Name | Type | Req | Description |
|---|---|---|---|
| jobId | string | – | – |
| requestId | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| acceptanceUnknown | boolean | yes | – |
| accountRequestStatus | string | yes | – |
| createdAt | string | – | – |
| durationSeconds | number | – | – |
| elapsedSeconds | number | – | – |
| environment | string | yes | – |
| jobId | string | – | – |
| message | string | – | – |
| progressPercent | number | – | – |
| quotaSource | string | yes | – |
| requestId | string | – | – |
| resultAssetId | string | – | – |
| retryAllowed | boolean | yes | – |
| status | string | yes | – |
| timing | object | – | – |
| updatedAt | string | – | – |
No examples provided.
upload_trifit_image Save a selected photo to TriFit ~116
With explicit permission, import the selected personal or clothing image into the connected TriFit account. Resizes automatically, saves it in the website library and selects its photo/product slot. Product images also use the existing cached description preparation. Never import arbitrary URLs or retry an uncertain import automatically.
| Name | Type | Req | Description |
|---|---|---|---|
| clientImportId | string | yes | New UUID for this user-approved import. Preserve it; never replace it after an uncertain outcome. |
| file | object | yes | – |
| permissionConfirmed | boolean | yes | – |
| role | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| assetId | string | yes | – |
| environment | string | yes | – |
| librarySource | string | yes | – |
| reused | boolean | yes | – |
| role | string | yes | – |
| status | string | yes | – |
No examples provided.
How do I install the Velox TriFit: Virtual Try-On API MCP server?
Velox TriFit: Virtual Try-On API is a hosted endpoint at https://studio.v3lox.com/partner/trifit/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · studio.v3lox.com
claude mcp add --transport http velox-xr-velox-trifit-developer 'https://studio.v3lox.com/partner/trifit/mcp'
What is the Velox TriFit: Virtual Try-On API MCP server?
Velox TriFit: Virtual Try-On API is an MCP server listed in the public MCP registry as io.github.Velox-XR/velox-trifit-developer. Virtual try-on (VTO) API docs and SDK examples; OAuth account/guest photo uploads and try-ons. This page covers its hosted endpoint (https://studio.v3lox.com/partner/trifit/mcp).
Is the Velox TriFit: Virtual Try-On API MCP server safe to use?
Velox TriFit: Virtual Try-On API scores 62 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Velox TriFit: Virtual Try-On API MCP server expose?
Velox TriFit: Virtual Try-On API exposes 18 tools: get_trifit_account, get_trifit_profile, get_trifit_allowance, list_trifit_library, prepare_trifit_upload, and 13 more. Their descriptions and schemas cost roughly 1,346 tokens of context every time the server is loaded.
Does the Velox TriFit: Virtual Try-On API MCP server require authentication?
No. We connected to Velox TriFit: Virtual Try-On API without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Velox TriFit: Virtual Try-On API MCP server still maintained?
Velox TriFit: Virtual Try-On API is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.