# Velox TriFit: Virtual Try-On API (remote · studio.v3lox.com)

Virtual try-on (VTO) API docs and SDK examples; OAuth account/guest photo uploads and try-ons.

- Trust score: 62/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `studio.v3lox.com`: 62/100 (this document), [markdown](https://verifymcp.io/servers/velox-xr-velox-trifit-developer/partner-trifit-mcp.md), [page](https://verifymcp.io/servers/velox-xr-velox-trifit-developer/partner-trifit-mcp)

## Channel facts

- Endpoint: `https://studio.v3lox.com/partner/trifit/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `2.0.1`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 57/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (create_trifit_try_on).
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 43/100
  - 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1793 tokens (~89/item across 20 items; 18 tools + 2 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 40/100
  - Stability observed for 12 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 74/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 10% of tool parameters carry a description.
  - Structured output schemas are declared (94% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 18 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 20 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.
  - Supports UI / widget rendering.

## Install

### How do I install the Velox TriFit: Virtual Try-On API MCP server?

Velox TriFit: Virtual Try-On API is a hosted endpoint at https://studio.v3lox.com/partner/trifit/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http velox-xr-velox-trifit-developer 'https://studio.v3lox.com/partner/trifit/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "velox-xr-velox-trifit-developer": {
      "url": "https://studio.v3lox.com/partner/trifit/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "velox-xr-velox-trifit-developer": {
      "type": "http",
      "url": "https://studio.v3lox.com/partner/trifit/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.velox-xr-velox-trifit-developer]
url = "https://studio.v3lox.com/partner/trifit/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "velox-xr-velox-trifit-developer": {
      "type": "remote",
      "url": "https://studio.v3lox.com/partner/trifit/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add velox-xr-velox-trifit-developer --url 'https://studio.v3lox.com/partner/trifit/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  velox-xr-velox-trifit-developer:
    url: "https://studio.v3lox.com/partner/trifit/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "velox-xr-velox-trifit-developer": {
      "Transport": "http",
      "Url": "https://studio.v3lox.com/partner/trifit/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add velox-xr-velox-trifit-developer -t streamable-http -u 'https://studio.v3lox.com/partner/trifit/mcp'
```

### Other

```json
{
  "mcpServers": {
    "velox-xr-velox-trifit-developer": {
      "type": "http",
      "url": "https://studio.v3lox.com/partner/trifit/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-04 (score 62, +1)

No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-02 (score 61, +1)

No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-31 (score 60, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-29 (score 59, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-27 (score 58, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-25 (score 57, +1)

- [functional improvement] Stability: unverified → 0.03

### 2026-10-24 (score 56)

First indexed and scored.

## MCP tools (18)

### `get_trifit_account` (~46 tokens)

Read your connected TriFit profile

Identify whether this verified connection is a guest session or a personal TriFit account before choosing tools. Does not link, switch, create an account or trust a conversational email hint.

Output parameters:

- `environment` (string)
- `id` (string)
- `name` (string)
- `quotaSource` (string)

### `get_trifit_profile` (~43 tokens)

Identify your connected TriFit profile

Read the stable profile represented by this connection. No account creation, switching, uploads or generation. Use get_trifit_account for connection mode and allowance source.

Output parameters:

- `id` (string)
- `name` (string)
- `nickname` (string)

### `get_trifit_allowance` (~36 tokens)

Read your TriFit account allowance

Read the same daily, weekly and monthly allowances as the TriFit website. Does not create, reset or spend credits.

Output parameters:

- `checkedAt` (string)
- `environment` (string)
- `quotaSource` (string)
- `stages` (array)

### `list_trifit_library` (~56 tokens)

List your TriFit account history

Read metadata for your saved personal photos, products, looks and DressMe requests. No image bytes or guest history transfer.

Input parameters:

- `kind` (string)
- `limit` (integer)
- `offset` (integer)

Output parameters:

- `environment` (string)
- `items` (array)
- `librarySource` (string)
- `nextOffset`
- `total` (integer)

### `prepare_trifit_upload` (~165 tokens)

Prepare a local photo upload to TriFit

For a user-selected local file in Codex, with explicit permission: create a private, one-use upload URL valid for at most five minutes. PUT only that JPEG/PNG/WebP file as raw bytes, with its image Content-Type, no API/OAuth headers and no redirects. Do not print or share the URL. The PUT saves/resizes the image in the connected account library and selects its website photo/product slot; product images use cached description preparation. Preserve clientImportId and the returned assetId. Never retry an uncertain upload automatically. Preparing does not upload or generate.

Input parameters:

- `clientImportId` (string, required): Stable UUID for this user-approved import. Never replace after an uncertain upload.
- `permissionConfirmed` (boolean, required)
- `role` (string, required)

Output parameters:

- `clientImportId` (string)
- `environment` (string)
- `expiresAt` (string)
- `maxBytes` (integer)
- `method` (string)
- `role` (string)
- `uploadUrl` (string)

### `upload_trifit_image` (~116 tokens)

Save a selected photo to TriFit

With explicit permission, import the selected personal or clothing image into the connected TriFit account. Resizes automatically, saves it in the website library and selects its photo/product slot. Product images also use the existing cached description preparation. Never import arbitrary URLs or retry an uncertain import automatically.

Input parameters:

- `clientImportId` (string, required): New UUID for this user-approved import. Preserve it; never replace it after an uncertain outcome.
- `file` (object, required)
- `permissionConfirmed` (boolean, required)
- `role` (string, required)

Output parameters:

- `assetId` (string)
- `environment` (string)
- `librarySource` (string)
- `reused` (boolean)
- `role` (string)
- `status` (string)

### `create_trifit_try_on` (~126 tokens)

Create a TriFit account try-on

Only after explicit user approval, submit one DressMe request using two existing account image IDs. Uses the website queue and existing account allowance, not the guest demo. The attempt can consume allowance. Never automatically retry, replace the request ID or claim that a timeout means it did not run. Check the original receipt.

Input parameters:

- `permissionConfirmed` (boolean, required)
- `personalAssetId` (string, required)
- `productAssetId` (string, required)
- `requestId` (string, required): New stable UUID for this approved request. Do not change it or replay after an uncertain response.

Output parameters:

- `acceptanceUnknown` (boolean)
- `createdAt` (string)
- `elapsedSeconds` (number)
- `environment` (string)
- `jobId` (string)
- `message` (string)
- `progressPercent` (number)
- `quotaSource` (string)
- `requestId` (string)
- `resultAssetId` (string)
- `retryAllowed` (boolean)
- `status` (string)
- `timing` (object)
- `updatedAt` (string)

### `get_trifit_try_on` (~64 tokens)

Read an existing TriFit request

Read the status, recorded duration and result ID of an existing account DressMe request without generating or replaying. A missing receipt means acceptance is uncertain, not that it never ran.

Input parameters:

- `jobId` (string)
- `requestId` (string)

Output parameters:

- `acceptanceUnknown` (boolean)
- `createdAt` (string)
- `elapsedSeconds` (number)
- `environment` (string)
- `jobId` (string)
- `message` (string)
- `progressPercent` (number)
- `quotaSource` (string)
- `requestId` (string)
- `resultAssetId` (string)
- `retryAllowed` (boolean)
- `status` (string)
- `timing` (object)
- `updatedAt` (string)

### `show_trifit_try_on` (~64 tokens)

Show an existing TriFit result

Show a completed account DressMe image inside the conversation. Requires separate private-image permission. Uses only the existing result; no generation, upload, public share or new allowance is used.

Input parameters:

- `jobId` (string)
- `requestId` (string)

Output parameters:

- `acceptanceUnknown` (boolean)
- `accountRequestStatus` (string)
- `createdAt` (string)
- `durationSeconds` (number)
- `elapsedSeconds` (number)
- `environment` (string)
- `jobId` (string)
- `message` (string)
- `progressPercent` (number)
- `quotaSource` (string)
- `requestId` (string)
- `resultAssetId` (string)
- `retryAllowed` (boolean)
- `status` (string)
- `timing` (object)
- `updatedAt` (string)

### `get_guest_demo_status` (~32 tokens)

Check guest try-on allowance

Read the current private guest-session allowance and its perSessionLimit denominator. Does not upload images or generate anything.

Output parameters:

- `busy` (boolean)
- `dailyLimit` (number)
- `environment` (string)
- `minimumStartGapSeconds` (number)
- `perSessionLimit` (number)
- `queueMode` (string)
- `queuePaused` (boolean)
- `remainingToday` (number)
- `requestId` (string|null)
- `sessionExpiresAt` (string)
- `sessionRemaining` (number)
- `timeZone` (string)

### `prepare_guest_upload` (~83 tokens)

Prepare a private local image upload

For Codex/local files: reserve one single-use HTTPS PUT upload for a personal photo or product image. Upload the user-selected file bytes to the returned URL; do not disclose that capability. Server resizes JPEG, PNG or WebP automatically. At most one upload per role per guest session. This does not generate a try-on.

Input parameters:

- `role` (string, required)

Output parameters:

- `expiresInSeconds` (number)
- `maxBytes` (number)
- `method` (string)
- `role` (string)
- `uploadUrl` (string)

### `create_try_on` (~148 tokens)

Create one guest virtual try-on

Generate a DressMe virtual try-on from the user’s personal photo and clothing reference only after their explicit request and permission. In ChatGPT pass both attached image files; in Codex pass the two asset IDs returned by completed private uploads. Use one method, not both. Consumes one session attempt and one shared daily attempt. One attempt per guest session, ten per day across all guests. Do not automatically retry or bypass limits. Returns a receipt; get_try_on retrieves its status/result.

Input parameters:

- `consent` (boolean, required)
- `garment_image` (object)
- `personal_asset_id` (string)
- `personal_image` (object)
- `product_asset_id` (string)

Output parameters:

- `createdAt` (string)
- `durationSeconds` (number)
- `error` (string)
- `failureCode` (string)
- `failureHttpStatus` (number)
- `failureStage` (string)
- `jobId` (string)
- `minimumStartGapSeconds` (number)
- `queuePaused` (boolean)
- `queuePosition` (number|null)
- `requestId` (string)
- `resultAssetId` (string)
- `status` (string)
- `submissionAttempted` (boolean)
- `timing` (object)
- `updatedAt` (string)

### `get_try_on` (~90 tokens)

Read your guest try-on result

Read only an existing request belonging to this authenticated guest session. With include_image=true, shows the completed image in a result card in ChatGPT and an inline image in other MCP clients. Does not create/retry a generation. Poll no more often than once every five seconds. A needs_review result must not be replayed.

Input parameters:

- `include_image` (boolean)
- `request_id` (string, required)

Output parameters:

- `createdAt` (string)
- `durationSeconds` (number)
- `error` (string)
- `failureCode` (string)
- `failureHttpStatus` (number)
- `failureStage` (string)
- `jobId` (string)
- `minimumStartGapSeconds` (number)
- `queuePaused` (boolean)
- `queuePosition` (number|null)
- `requestId` (string)
- `resultAssetId` (string)
- `status` (string)
- `submissionAttempted` (boolean)
- `timing` (object)
- `updatedAt` (string)

### `search` (~46 tokens)

Search Velox developer documentation

Find official Velox DressMe virtual try-on integration documentation, authentication, SDK languages, upload, polling and recovery guidance. Searches only the deployed public documentation corpus.

Input parameters:

- `query` (string, required)

Output parameters:

- `results` (array)

### `fetch` (~45 tokens)

Read a Velox developer document

Read the full public document for an ID returned by search, with an official source URL and deployed content checksum. Does not fetch arbitrary URLs or private files.

Input parameters:

- `id` (string, required)

Output parameters:

- `id` (string)
- `sha256` (string)
- `text` (string)
- `title` (string)
- `url` (string)

### `get_integration_example` (~57 tokens)

Get a Velox SDK integration example

Retrieve the runnable offline JavaScript/Node.js integration example or accompanying TypeScript declarations. Other language SDKs are not released. The example uses dummy local responses, with no cloud calls or generation charges.

Input parameters:

- `language` (string, required)

Output parameters:

- `declarations` (object)
- `example` (object)
- `language` (string)
- `productionGuidance` (object)
- `repository` (string)
- `setup` (array)
- `simulated` (boolean)

### `get_partner_access_requirements` (~52 tokens)

Get Velox partner access requirements

Explain how to apply for manually provisioned Velox Partner API access and keep the scoped application key on a backend. Does not create accounts, issue keys, send an application or promise a universal free allowance.

Output parameters:

- `allowance` (string)
- `applicationTopic` (string)
- `applicationUrl` (string)
- `credentials` (string)
- `provisioning` (string)
- `sdkReference` (string)
- `shopperAuthentication` (string)
- `source` (object)

### `get_partner_application_guide` (~77 tokens)

Apply to the TriFit team through your connected mailbox

Read the official in-chat Partner API application workflow: partner@v3lox.com, sender confirmation, optional project details, draft preview, send approval and actual reply verification. Public guidance only; this tool does not send email, inspect a mailbox, submit a form, issue keys or change access. No TriFit account is required.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/velox-xr-velox-trifit-developer/partner-trifit-mcp#diagnostics

## Score history

- 2026-11-05: 62
- 2026-11-04: 62
- 2026-11-03: 61
- 2026-11-02: 61
- 2026-11-01: 60
- 2026-10-31: 60
- 2026-10-30: 59
- 2026-10-29: 59
- 2026-10-28: 58
- 2026-10-27: 58
- 2026-10-26: 57
- 2026-10-25: 57
- 2026-10-24: 56

## Common questions

### What is the Velox TriFit: Virtual Try-On API MCP server?

Velox TriFit: Virtual Try-On API is an MCP server listed in the public MCP registry as io.github.Velox-XR/velox-trifit-developer. Virtual try-on (VTO) API docs and SDK examples; OAuth account/guest photo uploads and try-ons. This page covers its hosted endpoint (https://studio.v3lox.com/partner/trifit/mcp).

### Is the Velox TriFit: Virtual Try-On API MCP server safe to use?

Velox TriFit: Virtual Try-On API scores 62 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Velox TriFit: Virtual Try-On API MCP server expose?

Velox TriFit: Virtual Try-On API exposes 18 tools: get_trifit_account, get_trifit_profile, get_trifit_allowance, list_trifit_library, prepare_trifit_upload, and 13 more. Their descriptions and schemas cost roughly 1,346 tokens of context every time the server is loaded.

### Does the Velox TriFit: Virtual Try-On API MCP server require authentication?

No. We connected to Velox TriFit: Virtual Try-On API without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the Velox TriFit: Virtual Try-On API MCP server still maintained?

Velox TriFit: Virtual Try-On API is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://studio.v3lox.com/partner/trifit/mcp
- Repository: https://github.com/Velox-XR/trifit-partner-api-example
- Website: https://studio.v3lox.com/partner-api
- Changelog RSS feed: https://verifymcp.io/servers/velox-xr-velox-trifit-developer/partner-trifit-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/velox-xr-velox-trifit-developer/partner-trifit-mcp.json
- HTML version of this page: https://verifymcp.io/servers/velox-xr-velox-trifit-developer/partner-trifit-mcp