Skip to content

MCP servers › com.usespur › spur

MCP server · registry snapshot 2026-10-26 · last tested 2026-10-26

com.usespur/spur

by usespur.com · domain (the registry's namespace rule)Website ↗

Real estate leads, skip tracing, direct mail, SMS & email outreach, and marketing automations — the publisher's description

1 of 2 record checks metRead-only · tools listed 2026-10-26version 1.0.0streamable HTTP87 tools

Summary

com.usespur/spur is a remote MCP server listed in the official MCP registry at version 1.0.0, under the namespace of the domain usespur.com. On 2026-10-26 ProtocolProbe connected to it in read-only mode and read its inventory: 87 tools, 9 resources and 7 prompts.

Record checks

1 of 2 record checks met · 7 do not apply

  • met: Registry entry is active and says how to run it
  • not met: Source repository link opens
  • not applicable: Repository is not archived
  • not applicable: Code pushed to the repository in the 90 days before our check
  • not applicable: Repository publishes a security policy (SECURITY.md)
  • not applicable: Package names its licence with a standard (SPDX) identifier
  • not applicable: The version the registry lists can be installed and is not withdrawn
  • not applicable: npm package carries build provenance (attestation)
  • not applicable: No known critical or high advisory in the package or its dependencies
  • Not ranked by downloads: a remote server publishes no download figure
  • Not ranked by stars: no public GitHub repository

From public records, not a safety rating. Each check with its reason

Key facts

Runs
remote (hosted by the publisher)
Transport
streamable HTTP
Your own values
none declared (not a guarantee)
Sign-in
none needed to open a session
Tools
87
Last tested
2026-10-26

Tool list size

40,608 tokens on Claude Opus 5.5

Added to every request that loads this server's tools (87 tools). Counted with Anthropic's token counter on 2026-10-26, from the tool list we read on 2026-10-26. Median across 23,424 counted servers: 2,725 tokens. How it is counted

How a client gets in

Connects without signing in

Read from the server's public metadata on 2026-10-26 (mcp.usespur.com), in our read-only connection; no tool was called. It may have changed since. How it is read

Tool list at the three APIs

Not sent yet for this version (1.0.0).

Add to your client

Observed fact

This server accepted a session without any credential and lists 41 tools whose name or declaration suggests they change data (spur_save_properties, spur_enrich, spur_create_property_list, spur_add_properties_to_list, spur_create_workflow and 36 more). That is our reading of the names; we did not call them. Source: our connection, 2026-10-26.

How fresh this is

Live-tested
yes, a real session (not a text-only review)
Last tested
2026-10-26
Mode
read-only (no tool calls)
Latest version
1.0.0, published 2026-10-24 (registry, as of the 2026-10-26 snapshot)
First listed version
2026-10-24 (earliest version still in the registry; older removed versions would be earlier)
Registry data
snapshot 2026-10-26
Package and repository
checked 2026-10-26
Engine
mcp-runtime-engine@0.1.0 · sdk@1.32.0

Dead or stale signals

None found in the records we hold

Looked for and not found: deprecated in the registry. Does not apply: listed version cannot be installed or is withdrawn; repository link does not open; repository archived; no push in over 365 days. Each line is a dated fact from a public record. It does not say whether the server still works, and a record can change after the date shown.

Changes since the last refresh

New in the registry: not in the list of 2026-10-24, listed on 2026-10-26 with version 1.0.0 (published 2026-10-24).

Source: the official MCP Registry list on 2026-10-24 and on 2026-10-26.

What it is

What does this server offer?

Observed inventory
87tools
9resources
7prompts

None of its 87 tools are described as changing anything. For 87 the reading was uncertain, so no mark is shown.

  • spur_search_properties

    “Search live listings (Zillow data) in Spur with plain English and/or structured filters, including event filters.”

    Publisher declares: read-only yes · destructive no · idempotent no · open-world yes

    53 inputs
    • querystring“Free-text intent; Spur's AI turns it into filters and re-ranks by description”
    • locationstring“City and state ("Dallas, TX") or ZIP code”
    • listing_statusstring“Defaults to forRent when omitted and the query doesn't imply one”
    • min_pricenumber“Minimum price (monthly rent for rentals), USD”
    • max_pricenumber“Maximum price (monthly rent for rentals), USD”
    • home_typestring“Zillow home type code”
    • listing_typestring“Seller / listing kind; for catching NEW entries into a distress stage prefer events”
    • min_bedsinteger“Minimum bedrooms”
    • max_bedsinteger“Maximum bedrooms”
    • min_bathsnumber“Minimum bathrooms (half baths count as 0.5)”
    • max_bathsnumber“Maximum bathrooms”
    • min_sqftinteger“Minimum living area in square feet”
    • max_sqftinteger“Maximum living area in square feet”
    • min_lot_sizeinteger“Square feet (1 acre = 43,560)”
    • max_lot_sizeinteger“Square feet”
    • min_year_builtinteger“Built in or after this year”
    • max_year_builtinteger“Built in or before this year”
    • min_ageinteger“Years since built”
    • max_ageinteger“At most this many years since built”
    • days_postedinteger“Only listings posted within this many days”
    • min_days_on_marketinteger“Listed at least this many days (higher suggests a motivated seller)”
    • max_days_on_marketinteger“Listed at most this many days”
    • keywordsstring“Comma-separated listing keywords, e.g.”
    • has_poolboolean“true = only listings with a pool”
    • has_garageboolean“true = only listings with a garage”

    and 28 more not listed here.

  • spur_parse_search_query

    “Show how Spur interprets a plain-English property search (filters and events) without running it.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    1 input, 1 required
    • querystringrequired“The user's search in their own words”
  • spur_get_property

    “Show one property as a detailed card: a saved Spur property by property_id, or a live listing by zpid.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes

    2 inputs
    • property_idstring“Saved Spur property id”
    • zpidstring or number“Zillow property id from search results”
  • spur_save_properties

    “Save live listings into the user's Spur properties (and optionally a property list).”

    Publisher declares: read-only no · destructive no · idempotent no · open-world no

    2 inputs, 1 required
    • listingsarrayrequired“Listing objects copied unchanged from spur_search_properties structuredContent.cards[].listing”
    • list_idstring“Also add the saved properties to this property list (spur_list_property_lists)”
  • spur_list_saved_properties

    “List properties the user has saved in Spur, optionally filtered by city, state, list, or enrichment status.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    8 inputs
    • citystring“City name, e.g.”
    • statestring“Two-letter state, e.g.”
    • list_idstring“Only properties in this property list”
    • enrichment_statusstring“Skip-trace status of the property's owner (spur_enrich)”
    • min_pricenumber“Minimum price in USD (rent per month for rentals)”
    • max_pricenumber“Maximum price in USD (rent per month for rentals)”
    • limitinteger“Maximum number of items to return”
    • offsetinteger“Number of items to skip, for pagination”
  • spur_get_property_stats

    “Totals for the user's saved properties: counts by status, enrichment progress and similar portfolio-level numbers.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    Takes no inputs.

  • spur_find_owners

    “Find property owners in the user's Spur account by name, phone, email or mailing address text.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    5 inputs
    • querystring“Text to match against name, email, phone or mailing address”
    • enrichment_statusstring“Only owners with this skip-trace status”
    • has_phoneboolean“Only owners with at least one phone number”
    • limitinteger“Maximum number of items to return”
    • offsetinteger“Number of items to skip, for pagination”
  • spur_get_owner

    “Full owner record: contact details, mailing address, enrichment status and their property portfolio in Spur.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    1 input, 1 required
    • owner_idstringrequired“Owner id (UUID from a Spur list/search tool)”
  • spur_enrich

    “Run skip tracing to find owners and their phone numbers, emails and mailing addresses.”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world yes

    3 inputs, 1 required
    • property_idsarray“Saved property ids whose owners to skip-trace”
    • owner_idsarray“Owner ids to skip-trace (from spur_find_owners)”
    • confirmbooleanrequired“Set to true ONLY after the user explicitly approved this exact action in the conversation.”
  • spur_list_property_lists

    “All of the user's property lists with ids and sizes.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    Takes no inputs.

  • spur_create_property_list

    “Create a property list, optionally seeding it with saved property ids.”

    Publisher declares: read-only no · destructive no · idempotent no · open-world no

    3 inputs, 1 required
    • namestringrequired“List name shown in Spur”
    • descriptionstring“Optional note about what the list is for”
    • property_idsarray“Saved property ids to add right away”
  • spur_add_properties_to_list

    “Add saved properties to an existing property list.”

    Publisher declares: read-only no · destructive no · idempotent yes · open-world no

    2 inputs, 2 required
    • list_idstringrequired“Property list id (UUID from a Spur list/search tool)”
    • property_idsarrayrequired“Saved property ids (from spur_list_saved_properties or spur_save_properties)”
Show 75 more tools
  • spur_draft_message

    “Draft an email, SMS or direct-mail message with Spur's AI.”

    Publisher declares: read-only no · destructive no · idempotent no · open-world no

    4 inputs, 2 required
    • channelstringrequired“Which kind of message to draft”
    • promptstringrequired“What to write, e.g.”
    • owner_idstring“Owner to personalize for (from spur_find_owners)”
    • property_idstring“Saved property the message is about”
  • spur_list_workflows

    “The user's multi-step outreach workflows (email/SMS/mail sequences) with status and enrollment counts.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    Takes no inputs.

  • spur_get_workflow

    “One outreach workflow's steps in order (including reply/open branches built in the app), with the email, SMS or mail template each send step uses and its step_id.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    1 input, 1 required
    • workflow_idstringrequired“Workflow id (UUID from a Spur list/search tool)”
  • spur_create_workflow

    “Create a multi-step outreach sequence from saved templates.”

    Publisher declares: read-only no · destructive no · idempotent no · open-world no

    3 inputs, 2 required
    • namestringrequired“Workflow name shown in Spur”
    • descriptionstring“Optional note about the workflow's goal”
    • stepsarrayrequired“Steps in run order: send_email / send_sms / send_direct_mail with a saved template_id, and wait steps (days, hours) between them”
  • spur_set_workflow_step_template

    “Set which saved template a workflow's send step uses (send_email ← email template, send_sms ← SMS template, send_direct_mail ← postcard/letter template).”

    Publisher declares: read-only no · destructive no · idempotent yes · open-world no

    3 inputs, 3 required
    • workflow_idstringrequired“Workflow id (UUID from a Spur list/search tool)”
    • step_idstringrequired“step_id from spur_get_workflow”
    • template_idstringrequired“Template id (UUID from a Spur list/search tool)”
  • spur_set_workflow_active

    “Activate a workflow (enrolled owners start receiving its emails, texts and mail on schedule, which uses credits) or pause it.”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world yes

    3 inputs, 2 required
    • workflow_idstringrequired“Workflow id (UUID from a Spur list/search tool)”
    • activebooleanrequired“true = activate (start sending), false = pause”
    • confirmboolean“Required (true) when activating, only after the user approved it”
  • spur_enroll_owners_in_workflow

    “Enroll owners in an outreach workflow.”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world yes

    3 inputs, 3 required
    • workflow_idstringrequired“Workflow id (UUID from a Spur list/search tool)”
    • owner_idsarrayrequired“Owner ids to enroll (from spur_find_owners); owners without the needed contact details are skipped”
    • confirmbooleanrequired“Set to true ONLY after the user explicitly approved this exact action in the conversation.”
  • spur_send_sms

    “Text an owner from the user's default approved number (or Spur's workspace number if they have none; see spur_get_texting_setup).”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world yes

    3 inputs, 3 required
    • owner_idstringrequired“Owner id (UUID from a Spur list/search tool)”
    • messagestringrequired“Exact SMS text the user approved”
    • confirmbooleanrequired“Set to true ONLY after the user explicitly approved this exact action in the conversation.”
  • spur_list_sms_conversations

    “SMS conversations with owners, newest first, with unread counts and the last message.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    2 inputs
    • unread_onlyboolean“true = only conversations with unread replies”
    • limitinteger“Maximum conversations to return”
  • spur_get_sms_conversation

    “The full SMS thread with one owner, oldest first.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    1 input, 1 required
    • owner_idstringrequired“Owner id (UUID from a Spur list/search tool)”
  • spur_get_outreach_report

    “Outreach performance (sent, delivered, opened, replied, by channel) for all workflows or one, over an optional date range.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    3 inputs
    • workflow_idstring“Report on one workflow only; omit for all workflows”
    • date_fromstring“ISO date, e.g.”
    • date_tostring“ISO date”
  • spur_list_message_templates

    “The user's saved email and SMS templates.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    1 input
    • channelstring“Only email or only SMS templates; omit for both”
  • spur_get_message_template

    “Fetch an email template's subject, HTML and plain text, or an SMS template's text, for reading or editing.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    1 input, 1 required
    • template_idstringrequired“Email or SMS template id (UUID from a Spur list/search tool)”
  • spur_preview_message_template

    “Show a saved email (inbox view, desktop and mobile) or SMS (phone view, segment count) rendered with sample data or a real owner's data, plus design checks.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    2 inputs, 1 required
    • template_idstringrequired“Email or SMS template id (UUID from a Spur list/search tool)”
    • owner_idstring“Preview with this owner's real data (spur_find_owners) instead of sample data”
  • spur_preview_message_draft

    “Preview email HTML or SMS text before saving it: renders it with sample or real owner data and runs the design checks.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    6 inputs, 1 required
    • channelstringrequired“Whether the draft is an email or an SMS”
    • subjectstring“Email subject”
    • htmlstring“Email HTML”
    • textstring“SMS text, or the email's plain-text version”
    • fallback_bodystring“SMS only: link-free text sent if links are blocked”
    • owner_idstring“Preview with this owner's real data (spur_find_owners) instead of sample data”
  • spur_create_email_template

    “Save a new email template and show its inbox preview.”

    Publisher declares: read-only no · destructive no · idempotent no · open-world no

    8 inputs, 1 required
    • namestringrequired“Template name shown in Spur”
    • subjectstring“Required unless copying a template”
    • start_from_blankboolean“true = start from Spur's responsive, compliant blank email layout”
    • base_template_idstring“Copy this email template as the starting point”
    • htmlstring“Full email HTML; merge fields like {{owner_first_name}} are filled per recipient”
    • text_bodystring“Plain-text version; generated from the HTML when omitted”
    • descriptionstring“Internal note about the template; never sent to owners”
    • is_defaultboolean“Make this the user's default email template”
  • spur_update_email_template

    “Edit one of the user's email templates and show the updated inbox preview.”

    Publisher declares: read-only no · destructive no · idempotent yes · open-world no

    8 inputs, 1 required
    • template_idstringrequired“Email or SMS template id (UUID from a Spur list/search tool)”
    • namestring“New template name”
    • subjectstring“New subject line”
    • htmlstring“Full replacement HTML”
    • text_bodystring“Full replacement plain-text version”
    • descriptionstring“Internal note about the template; never sent to owners”
    • is_defaultboolean“true = make this the user's default template for its channel”
    • replacementsarray“Small edits applied in order instead of resending the full content”
  • spur_create_sms_template

    “Save a new SMS template and show its phone preview with segment count and checks.”

    Publisher declares: read-only no · destructive no · idempotent no · open-world no

    5 inputs, 2 required
    • namestringrequired“Template name shown in Spur”
    • textstringrequired“SMS body; merge fields like {{owner_first_name}} are filled per recipient”
    • fallback_bodystring“Link-free version sent if a link gets the text blocked”
    • descriptionstring“Internal note about the template; never sent to owners”
    • is_defaultboolean“true = make this the user's default template for its channel”
  • spur_update_sms_template

    “Edit one of the user's SMS templates and show the updated preview.”

    Publisher declares: read-only no · destructive no · idempotent yes · open-world no

    7 inputs, 1 required
    • template_idstringrequired“Email or SMS template id (UUID from a Spur list/search tool)”
    • namestring“New template name”
    • textstring“Full replacement SMS body”
    • fallback_bodystring“Link-free text sent instead when links are blocked; "" removes it”
    • descriptionstring“Internal note about the template; never sent to owners”
    • is_defaultboolean“true = make this the user's default template for its channel”
    • replacementsarray“Small edits applied in order instead of resending the full content”
  • spur_delete_message_template

    “Delete one of the user's email or SMS templates.”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world no

    2 inputs, 2 required
    • template_idstringrequired“Email or SMS template id (UUID from a Spur list/search tool)”
    • confirmbooleanrequired“Set to true ONLY after the user explicitly approved this exact action in the conversation.”
  • spur_send_test_email

    “Send an email template, filled with sample data (or one owner's data), to the user's own Spur account email from their email sender, to check it in a real inbox.”

    Publisher declares: read-only no · destructive no · idempotent no · open-world yes

    4 inputs, 2 required
    • template_idstringrequired“Email or SMS template id (UUID from a Spur list/search tool)”
    • owner_idstring“Preview with this owner's real data (spur_find_owners) instead of sample data”
    • sender_idstring“Email sender to send from; defaults to the user's default sender”
    • confirmbooleanrequired“Set to true ONLY after the user explicitly approved this exact action in the conversation.”
  • spur_list_postcard_templates

    “Postcard templates available to the user: their own (editable), Spur defaults, and Spur's built-in gallery.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    3 inputs
    • categorystring“Only templates in this category, e.g.”
    • sizestring“Only templates designed for this size”
    • include_galleryboolean“Include Spur's built-in gallery designs”
  • spur_get_postcard_template

    “Fetch a postcard template's HTML for reading or editing.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    2 inputs, 1 required
    • template_idstringrequired“Template id from spur_list_postcard_templates (a saved template's UUID or a Spur gallery id)”
    • sidestring“Which side's HTML to return”
  • spur_preview_postcard_template

    “Show any postcard template (yours, a Spur default or a gallery design) rendered with sample data, without changing anything.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    1 input, 1 required
    • template_idstringrequired“Template id from spur_list_postcard_templates (a saved template's UUID or a Spur gallery id)”
  • spur_create_postcard_template

    “Create a postcard template and show a preview.”

    Publisher declares: read-only no · destructive no · idempotent no · open-world no

    8 inputs, 1 required
    • namestringrequired“Template name shown in Spur”
    • start_from_blankboolean“Start from an empty canvas sized for `size`”
    • base_template_idstring“Copy this template's HTML and size as the starting point”
    • front_htmlstring“Full front-side HTML”
    • back_htmlstring“Full back-side HTML; keep the address block area clear”
    • sizestring“Postcard size: "6x4" (standard 4×6), "6x9" or "6x11"”
    • descriptionstring“Internal note about the template; never printed”
    • categorystring“Category label, e.g.”
  • spur_update_postcard_template

    “Edit one of the user's postcard templates and show the updated preview.”

    Publisher declares: read-only no · destructive no · idempotent yes · open-world no

    8 inputs, 1 required
    • template_idstringrequired“Template id (UUID from a Spur list/search tool)”
    • namestring“New template name”
    • descriptionstring“Internal note about the template; never printed”
    • categorystring“Category label, e.g.”
    • sizestring“Postcard size: "6x4" (standard 4×6), "6x9" or "6x11"”
    • front_htmlstring“Full replacement front HTML”
    • back_htmlstring“Full replacement back HTML”
    • replacementsarray“Small edits applied in order instead of resending the full content”
  • spur_add_postcard_qr_code

    “Put a tracked QR code on the back of one of the user's postcard templates and show the preview.”

    Publisher declares: read-only no · destructive no · idempotent yes · open-world no

    6 inputs, 2 required
    • template_idstringrequired“Postcard template id (UUID from a Spur list/search tool)”
    • qr_code_idstringrequired“QR code id from spur_list_qr_codes or spur_create_qr_code”
    • positionstring“Where to place the code on the back; auto fills the design's qr-box”
    • size_inchesnumber“Edge length when placed in the message area (not used for a slot).”
    • x_inchesnumber“Left edge, inches from the bleed's left edge (with y_inches; overrides position)”
    • y_inchesnumber“Top edge, inches from the bleed's top edge (with x_inches)”
  • spur_remove_postcard_qr_code

    “Remove the tracked QR code from one of the user's postcard templates (both sides) and show the preview.”

    Publisher declares: read-only no · destructive no · idempotent yes · open-world no

    1 input, 1 required
    • template_idstringrequired“Postcard template id (UUID from a Spur list/search tool)”
  • spur_delete_postcard_template

    “Permanently delete one of the user's postcard templates.”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world no

    2 inputs, 2 required
    • template_idstringrequired“Template id (UUID from a Spur list/search tool)”
    • confirmbooleanrequired“Set to true ONLY after the user explicitly approved this exact action in the conversation.”
  • spur_list_return_addresses

    “Return addresses saved for direct mail.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    Takes no inputs.

  • spur_preview_postcard_campaign

    “Required step before mailing postcards.”

    Publisher declares: read-only yes · destructive no · idempotent no · open-world no

    4 inputs, 2 required
    • template_idstringrequired“Postcard template id (UUID from a Spur list/search tool)”
    • owner_idsarrayrequired“Owners to mail (spur_find_owners)”
    • return_address_idstring“Defaults to the user's default return address”
    • sizestring“Defaults to the template's size”
  • spur_send_postcards

    “Mail the postcards approved in spur_preview_postcard_campaign.”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world yes

    2 inputs, 2 required
    • confirmation_tokenstringrequired“confirmation_token from spur_preview_postcard_campaign”
    • confirmbooleanrequired“Set to true ONLY after the user explicitly approved this exact action in the conversation.”
  • spur_list_qr_codes

    “The user's tracked QR codes: destination URL, colors, and which of their postcard templates print each one.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    Takes no inputs.

  • spur_create_qr_code

    “Create a tracked QR code that sends scans to destination_url.”

    Publisher declares: read-only no · destructive no · idempotent no · open-world no

    4 inputs, 2 required
    • namestringrequired“Label shown in Spur, e.g.”
    • destination_urlstringrequired“Where a scan sends people, e.g.”
    • foreground_colorstring“Hex color, e.g.”
    • background_colorstring“Hex color, e.g.”
  • spur_update_qr_code

    “Rename a QR code, change where scans go, or change its colors.”

    Publisher declares: read-only no · destructive no · idempotent yes · open-world no

    5 inputs, 1 required
    • qr_code_idstringrequired“QR code id from spur_list_qr_codes”
    • namestring“New name for the QR code”
    • destination_urlstring“Where a scan sends people, e.g.”
    • foreground_colorstring“Hex color, e.g.”
    • background_colorstring“Hex color, e.g.”
  • spur_delete_qr_code

    “Permanently delete a QR code.”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world no

    2 inputs, 2 required
    • qr_code_idstringrequired“QR code id from spur_list_qr_codes”
    • confirmbooleanrequired“Set to true ONLY after the user explicitly approved this exact action in the conversation.”
  • spur_get_qr_code_activity

    “Scan activity for a QR code: totals, which mailed recipients (owners) scanned their postcard, and recent scans of the code itself.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    2 inputs, 1 required
    • qr_code_idstringrequired“QR code id from spur_list_qr_codes”
    • limitinteger“Maximum recipients and scans to list”
  • spur_list_images

    “The user's saved images (logos, headshots, property photos) with their public URLs, newest first.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    1 input
    • limitinteger“Maximum images to return”
  • spur_save_image

    “Download an image from a public https URL (the user's website, a shared photo link) and save it to the user's Spur image library, so it stays available for printing and sending.”

    Publisher declares: read-only no · destructive no · idempotent no · open-world yes

    2 inputs, 1 required
    • urlstringrequired“Public https URL of the image”
    • filenamestring“Name to save it under, e.g.”
  • spur_upload_image

    “Show an upload box where the user picks or drops an image from their device (logo, headshot, property photo); it's saved to their Spur image library.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    1 input
    • purposestring“What the image is for, shown to the user, e.g.”
  • spur_save_uploaded_image

    “Used by the upload widget to save the file the user picked.”

    Publisher declares: read-only no · destructive no · idempotent no · open-world no

    2 inputs, 2 required
    • filenamestringrequired“Original file name”
    • data_base64stringrequired“File contents, base64-encoded”
  • spur_delete_image

    “Permanently delete one of the user's saved images.”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world no

    2 inputs, 2 required
    • image_idstringrequired“image_id from spur_list_images”
    • confirmbooleanrequired“Set to true ONLY after the user explicitly approved this exact action in the conversation.”
  • spur_list_letter_templates

    “Letter templates available to the user, with their letter type (Top First Page or Insert Blank Page): their own (editable), Spur defaults, and Spur's built-in gallery.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    3 inputs
    • categorystring“Only templates in this category”
    • letter_typestring“Only templates of this letter type”
    • include_galleryboolean“Include Spur's built-in gallery designs”
  • spur_get_letter_template

    “Fetch a letter template's HTML for reading or editing.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    1 input, 1 required
    • template_idstringrequired“Template id from spur_list_letter_templates (a saved template's UUID or a Spur gallery id)”
  • spur_preview_letter_template

    “Show any letter template (yours, a Spur default or a gallery design) rendered with sample data, without changing anything.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    1 input, 1 required
    • template_idstringrequired“Template id from spur_list_letter_templates (a saved template's UUID or a Spur gallery id)”
  • spur_create_letter_template

    “Create a letter template and show a preview.”

    Publisher declares: read-only no · destructive no · idempotent no · open-world no

    7 inputs, 1 required
    • namestringrequired“Template name shown in Spur”
    • letter_typestring“Defaults to the base template's type, else top_first_page”
    • start_from_blankboolean“Start from an empty page laid out for letter_type”
    • base_template_idstring“Copy this template's HTML and letter type as the starting point”
    • htmlstring“Full letter HTML”
    • descriptionstring“Internal note about the template; never printed”
    • categorystring“Category label, e.g.”
  • spur_update_letter_template

    “Edit one of the user's letter templates and show the updated preview.”

    Publisher declares: read-only no · destructive no · idempotent yes · open-world no

    7 inputs, 1 required
    • template_idstringrequired“Template id (UUID from a Spur list/search tool)”
    • namestring“New template name”
    • descriptionstring“Internal note about the template; never printed”
    • categorystring“Category label, e.g.”
    • letter_typestring“"top_first_page": the address prints in the top 3.15in of page 1 (shows through a #10 window envelope), so keep that band empty.”
    • htmlstring“Full replacement HTML”
    • replacementsarray“Small edits applied in order instead of resending the full content”
  • spur_delete_letter_template

    “Permanently delete one of the user's letter templates.”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world no

    2 inputs, 2 required
    • template_idstringrequired“Template id (UUID from a Spur list/search tool)”
    • confirmbooleanrequired“Set to true ONLY after the user explicitly approved this exact action in the conversation.”
  • spur_preview_letter_campaign

    “Required step before mailing letters.”

    Publisher declares: read-only yes · destructive no · idempotent no · open-world no

    5 inputs, 2 required
    • template_idstringrequired“Letter template id (UUID from a Spur list/search tool)”
    • owner_idsarrayrequired“Owners to mail (spur_find_owners)”
    • return_address_idstring“Defaults to the user's default return address”
    • colorboolean“Print in color (false for black and white)”
    • double_sidedboolean“Print on both sides of each sheet”
  • spur_send_letters

    “Mail the letters approved in spur_preview_letter_campaign.”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world yes

    2 inputs, 2 required
    • confirmation_tokenstringrequired“confirmation_token from spur_preview_letter_campaign”
    • confirmbooleanrequired“Set to true ONLY after the user explicitly approved this exact action in the conversation.”
  • spur_get_billing_summary

    “Plan, wallet balance, and this period's usage and remaining allowance per feature (searches, enrichment, SMS, postcards, letters, AI).”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    Takes no inputs.

  • spur_list_campaigns

    “The user's campaigns (bulk email, SMS, direct mail, outreach) with status and recipient progress.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    3 inputs
    • statusstring“Only campaigns with this status”
    • limitinteger“Maximum campaigns to return”
    • offsetinteger“Campaigns to skip, for paging”
  • spur_get_campaign_stats

    “Delivery and run statistics for one campaign.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    1 input, 1 required
    • campaign_idstringrequired“Campaign id (UUID from a Spur list/search tool)”
  • spur_get_direct_mail_analytics

    “Letters and postcards sent, delivered, in transit and returned, plus USPS tracking totals and spend.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    Takes no inputs.

  • spur_show_billing_options

    “Shows the user's wallet balance, one-click top-up amounts, auto-recharge status and every Spur plan with prices, in a widget with Pay/Upgrade buttons.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    Takes no inputs.

  • spur_top_up_wallet

    “Creates a Stripe checkout link to add funds to the user's Spur wallet (pays for postcards, letters, SMS, enrichment and other usage beyond the plan).”

    Publisher declares: read-only no · destructive no · idempotent no · open-world yes

    1 input, 1 required
    • amount_usdnumberrequired“Amount to add in US dollars (minimum $5)”
  • spur_change_plan

    “Moves the user to another Spur plan (ids from spur_show_billing_options; usually agent, team or brokerage).”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world yes

    3 inputs, 1 required
    • plan_idstringrequired“Target plan id, e.g.”
    • billing_intervalstring“annual is cheaper per month”
    • confirmboolean“Only for users who already have a paid subscription: true ONLY after they approved the switch and the prorated charge in the conversation.”
  • spur_check_payment

    “After the user pays a Stripe checkout link from spur_top_up_wallet or spur_change_plan, confirms the payment went through and returns the new wallet balance and plan.”

    Publisher declares: read-only no · destructive no · idempotent yes · open-world no

    1 input, 1 required
    • session_idstringrequired“session_id returned with the checkout link (starts with cs_)”
  • spur_manage_billing

    “Link to the user's Stripe billing portal: update the card on file, download invoices, change or cancel the subscription.”

    Publisher declares: read-only no · destructive no · idempotent no · open-world yes

    Takes no inputs.

  • spur_set_auto_recharge

    “Turns wallet auto-recharge on or off.”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world yes

    4 inputs, 1 required
    • enabledbooleanrequired“true = turn auto-recharge on, false = off”
    • amount_usdnumber“Amount added per recharge (required when enabling, minimum $5)”
    • threshold_usdnumber“Recharge when the balance drops below this (required when enabling; lower than amount_usd)”
    • confirmboolean“Required to enable: true ONLY after the user approved automatic charges of this amount at this threshold.”
  • spur_list_search_automations

    “Scheduled property searches with their schedule, filters, and next/last run times.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    Takes no inputs.

  • spur_create_search_automation

    “Schedule a recurring property search.”

    Publisher declares: read-only no · destructive no · idempotent no · open-world no

    57 inputs, 4 required
    • namestringrequired“Automation name shown in Spur”
    • locationstringrequired“City/state or ZIP, e.g.”
    • frequencystringrequired“How often the search runs”
    • run_timestringrequired“24h local time "HH:MM"”
    • timezonestring“IANA time zone, e.g.”
    • day_of_weekinteger“0=Sunday … 6=Saturday; for weekly, biweekly, monthly”
    • week_of_monthnumber“Monthly only; -1 = last”
    • min_amountnumber“Minimum price in USD (rent per month for forRent)”
    • max_amountnumber“Maximum price in USD (rent per month for forRent)”
    • listing_statusstring“Which listings to search”
    • home_typestring“Zillow home type code”
    • listing_typestring“Seller / listing kind; for catching NEW entries into a distress stage prefer events”
    • min_bedsinteger“Minimum bedrooms”
    • max_bedsinteger“Maximum bedrooms”
    • min_bathsnumber“Minimum bathrooms (half baths count as 0.5)”
    • max_bathsnumber“Maximum bathrooms”
    • min_sqftinteger“Minimum living area in square feet”
    • max_sqftinteger“Maximum living area in square feet”
    • min_lot_sizeinteger“Square feet (1 acre = 43,560)”
    • max_lot_sizeinteger“Square feet”
    • min_year_builtinteger“Built in or after this year”
    • max_year_builtinteger“Built in or before this year”
    • min_ageinteger“Years since built”
    • max_ageinteger“At most this many years since built”
    • days_postedinteger“Only listings posted within this many days”

    and 32 more not listed here.

  • spur_run_search_automation

    “Run a search automation immediately instead of waiting for its schedule.”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world yes

    1 input, 1 required
    • automation_idstringrequired“Automation id (UUID from a Spur list/search tool)”
  • spur_get_automation_logs

    “Recent runs of a search automation: when, how many found/saved/enriched, and errors.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    2 inputs, 1 required
    • automation_idstringrequired“Automation id (UUID from a Spur list/search tool)”
    • limitinteger“Maximum runs to return”
  • spur_get_texting_setup

    “The user's texting setup: phone numbers bought in Spur (and which can send), carrier (A2P 10DLC) registration status, carrier notes, what's still missing, and the next step.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    1 input
    • refreshboolean“true = ask the carriers for the latest status first (use when the user is waiting on approval)”
  • spur_search_phone_numbers

    “Search local US numbers the user can buy, by area code, state, city or digits.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    5 inputs
    • area_codestring“e.g.”
    • statestring“e.g.”
    • citystring
    • containsstring“Digits the number should contain, e.g.”
    • limitinteger
  • spur_buy_phone_number

    “Buy a local number for the user's account (it's theirs immediately and replies land in their SMS inbox).”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world yes

    4 inputs, 2 required
    • phone_numberstringrequired“phone_number from spur_search_phone_numbers”
    • localitystring“City from the search result, for display”
    • regionstring“State from the search result, for display”
    • confirmbooleanrequired“Set to true ONLY after the user explicitly approved this exact action in the conversation.”
  • spur_set_default_phone_number

    “Make one of the user's bought numbers the default sender for their texts.”

    Publisher declares: read-only no · destructive no · idempotent yes · open-world no

    1 input, 1 required
    • number_idstringrequired“number_id from spur_get_texting_setup”
  • spur_release_phone_number

    “Permanently give up one of the user's bought numbers.”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world yes

    2 inputs, 2 required
    • number_idstringrequired“number_id from spur_get_texting_setup”
    • confirmbooleanrequired“Set to true ONLY after the user explicitly approved this exact action in the conversation.”
  • spur_save_texting_registration

    “Create or update the user's carrier (A2P 10DLC) registration draft.”

    Publisher declares: read-only no · destructive no · idempotent no · open-world no

    6 inputs
    • registration_typestring
    • business_infoobject
    • addressobject
    • contactobject
    • messagingobject
    • write_campaign_textboolean“true = also draft the campaign text from their website and answers”
  • spur_submit_texting_registration

    “Send the user's registration to the carriers (also resubmits a rejected one after fixes).”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world yes

    3 inputs, 3 required
    • user_confirms_consentbooleanrequired“The user confirmed they only text people who agreed to receive their messages and honor STOP requests”
    • user_confirms_no_prohibited_contentbooleanrequired“The user confirmed they won't send prohibited content”
    • confirmbooleanrequired“Set to true ONLY after the user explicitly approved this exact action in the conversation.”
  • spur_pay_texting_fees

    “Retry overdue monthly number and registration fees from the Spur wallet right away (normally retried daily).”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world yes

    1 input, 1 required
    • confirmbooleanrequired“Set to true ONLY after the user explicitly approved this exact action in the conversation.”
  • spur_resend_texting_verification

    “Sole proprietors only: re-send the carrier's verification text (the user replies YES) when the previous one expired after 24 hours.”

    Publisher declares: read-only no · destructive no · idempotent no · open-world no

    Takes no inputs.

  • “Search the user's saved Spur properties, owners and postcard templates by keyword (address, city, owner name, phone, email, template name).”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    1 input, 1 required
    • querystringrequired“Keywords: address, city, owner name, phone, email or template name”
  • “Fetch the full text of a record returned by search (ids look like property:…, owner:… or template:…).”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    1 input, 1 required
    • idstringrequired“Record id exactly as returned by search, e.g.”

Each quoted sentence is the first sentence of the publisher’s own description. The kind of tool and the “changes data” mark are our AI model’s reading of that description, not something we tested: two differently worded runs had to agree, otherwise no label is shown, and nobody has checked them by hand. A tool without the “changes data” mark is described as only reading, searching or calculating, or the two runs did not agree. No tool was called. Read the publisher’s full description before relying on it. “Publisher declares” lists the hints the server itself sends with the tool (MCP annotations: read-only, destructive, idempotent, open-world); they are the publisher's claims, not checked by us. Inputs are the parameters in the tool's own input schema: name, declared type, whether it is required, and the first sentence of its description. Read 2026-10-26.

How well are its tools described?

Features #4 and #5

How clearly this server's own tool descriptions say what a tool does, and how consistent its tool list is. The first part is an AI model's yes/no reading of each description; the second part is counted. We do not turn it into a grade.

Descriptions

AI reading of each description

No AI reading was available for this server's tools (the two runs did not agree, or the listing was not reviewed).

Counted from the listing

Parameters with a description
98% of 334
Tools with a description
100% of 87
Typical description length
409 characters

The tool set

Counted from the listing

Tools
87
Size of the list
about 29,661 tokens for an agent to load (characters ÷ 4)
Naming
85 of 87 names use snake_case

AI reading: easy to mix up

No pair found.

The AI items cover 0 of 87 tools: for a tool where two differently worded runs disagreed, that item is left out. They were not checked by hand, and no tool was called. “Easy to mix up” means two tools whose names or descriptions overlap without saying how they differ; the AI found none, comparing tools within groups of 40. We do not rate whether the tool set is complete or whether side effects are spelled out, because our AI reading of those was not reliable enough.

How do I add it to my client?

Config from the registry entry

From the remote endpoint (Streamable HTTP)

We connected to this URL on 2026-10-26 (a read-only session: no tool was called).

Add to CursorAn install link in the format Cursor documents, holding the Cursor config below.

Claude Desktop or claude.ai
Settings → Connectors → Add custom connector, then paste:
https://mcp.usespur.com/mcp
Cursor · .cursor/mcp.json in a project, or ~/.cursor/mcp.json
{
  "mcpServers": {
    "spur": {
      "url": "https://mcp.usespur.com/mcp"
    }
  }
}
VS Code · .vscode/mcp.json
{
  "servers": {
    "spur": {
      "type": "http",
      "url": "https://mcp.usespur.com/mcp"
    }
  }
}
VS Code (command line) · Bash or zsh terminal (macOS, Linux)
code --add-mcp '{"name":"spur","type":"http","url":"https://mcp.usespur.com/mcp"}'
Claude Code
claude mcp add --transport http spur https://mcp.usespur.com/mcp
Cline · cline_mcp_settings.json (Cline CLI: ~/.cline/data/settings/; in the editor: MCP Servers → Configure → Configure MCP Servers)
{
  "mcpServers": {
    "spur": {
      "type": "streamableHttp",
      "url": "https://mcp.usespur.com/mcp",
      "disabled": false,
      "autoApprove": []
    }
  }
}
Gemini CLI · ~/.gemini/settings.json, or .gemini/settings.json in a project
{
  "mcpServers": {
    "spur": {
      "httpUrl": "https://mcp.usespur.com/mcp"
    }
  }
}
OpenAI Codex · ~/.codex/config.toml, or .codex/config.toml in a trusted project
[mcp_servers.spur]
url = "https://mcp.usespur.com/mcp"
Zed · Zed settings file (command: zed: open settings file)
{
  "context_servers": {
    "spur": {
      "url": "https://mcp.usespur.com/mcp"
    }
  }
}
Try it in the MCP Inspector · runs on your machine, opens in your browser · Node 22.19+
npx @modelcontextprotocol/inspector@2.11.0 --server-url https://mcp.usespur.com/mcp --transport http
  • The server runs on the operator's infrastructure; it may ask you to sign in when you first connect.
  • Zed's docs we read on 2026-10-26 describe remote servers by URL and do not name the transport.
  • The MCP Inspector lists the server's tools, resources and prompts; a tool you call there runs for real.

Built from the server's registry entry with each client's documented format (checked 2026-10-14; the Cursor link and the VS Code command 2026-10-19; the MCP Inspector command 2026-10-21; Cline, Gemini CLI, OpenAI Codex and Zed 2026-10-26). Values in < > are yours to fill in; this page never contains a key. Where the server needs a setting the entry does not declare, it can still fail to start.

Does the registry listing match what we found?

Feature #6

The registry verifies a package once, when it is published, and does not re-check it. A difference below is about the listing, not a judgement of the publisher.

Registry saysWe foundResultSource · date
Remote endpoint mcp.usespur.com/mcpSession openedmatchesour test · 2026-10-26
No credential declared as requiredOpened a session without any credentialmatchesour test · 2026-10-26

Choosing

Record checks

Public records · not a safety rating

1 of 2 record checks met · 7 do not apply

  • Not ranked by downloads: a remote server publishes no download figure
  • Not ranked by stars: no public GitHub repository
  • MetRegistry entry is active and says how to run itActive, with a package or a remote address.
  • Not metSource repository link opensThe registry entry gives no repository link.
  • Does not applyRepository is not archivedNo public GitHub repository to read.
  • Does not applyCode pushed to the repository in the 90 days before our checkNo public GitHub repository to read.
  • Does not applyRepository publishes a security policy (SECURITY.md)No public GitHub repository to read.
  • Does not applyPackage names its licence with a standard (SPDX) identifierRemote server: it ships no package.
  • Does not applyThe version the registry lists can be installed and is not withdrawnRemote server: it ships no package.
  • Does not applynpm package carries build provenance (attestation)Remote server: it ships no package.
  • Does not applyNo known critical or high advisory in the package or its dependenciesRemote server: it ships no package.

Read from public records only: the registry entry, npm/PyPI, GitHub and advisory databases, checked 2026-10-26. No tool was called. Only “met” and “not met” are counted, so the total differs between servers; a check that does not apply or that we could not run is listed, never counted against it. It is not a safety rating. How each check works · Leaderboards

Common questions about com.usespur/spur

Answered from the data above

Who publishes com.usespur/spur?

The registry ties the namespace com.usespur to the domain usespur.com; only its owner can publish under it. These are facts from the registry and GitHub, not a rating.

Does com.usespur/spur need an API key or sign-in?

It opened a session without any credential on 2026-10-26. The registry entry declares no required credential; no declaration is not a guarantee.

Has com.usespur/spur been security tested?

Partly. 4 of the 16 checks that apply to it were exercised. It accepted a session without any credential and lists tools whose names suggest they change data. We did not call them. No security verdict is published before verification.

Found this page useful?

Anonymous · no sign-in

A quick, anonymous reaction — no account, no email. One per kind from your browser. The tally updates when the page is next refreshed, and it is only a rough count, never a safety rating or a measured number of people.

Compare with another server

Side by side: registry entry, our read-only session, the tools and the 18 classification fields. Same values as each page; no score.

Security testing

What did we test, and what did we leave out?

18 checks · features #1, #2

Open without sign-in

It accepted a session without any credential and lists tools whose names suggest they change data. We did not call them. No security score is given; a check we did not run is never counted as passed.

The 18 checks at a glanceour test · 2026-10-26
  1. Inventory: exercised
  2. Hidden instructions: exercised
  3. Real execution: not run · our policy
  4. Secret leak: not run · nothing to check it against
  5. Internal addresses: not run · our policy
  6. Unconfirmed changes: not run · our policy
  7. Bad input: not run · our policy
  8. Model requests: not run · nothing to check it against
  9. Sensitive questions: not run · nothing to check it against
  10. Folder boundary: not run · our policy
  11. Log leaks: not run · nothing to check it against
  12. Hidden content: exercised
  13. Fake assistant turns: not run · an error was returned
  14. Token passthrough: not applicable
  15. Token audience: not applicable
  16. Sign-in redirect: not run · our policy
  17. Consent handling: not testable from outside
  18. Sign-in metadata: exercised

4 exercised12 not run (reason given)2 not applicable

Each check ends in exactly one state: exercised, not run (with the reason), or not applicable (with the reason). 4 of the 16 checks that apply to it were exercised. We do not publish security-check outcomes for named servers.

Exercised · 4
  • 1Inventory
    tool-list
    Reads the declared tools, resources and prompts.exercised
  • 2Hidden instructions
    description-poisoning
    Looks for hidden instructions in tool descriptions.exercised
  • 12Hidden content
    audience-hiding
    Checks resources that hide content from the user.exercised
  • 18Sign-in metadata
    oauth-url-scheme
    Checks the published sign-in metadata for unsafe URLs.exercised
Not run, with the reason · 12
  • 3Real execution
    real-execution
    Calls a tool and checks what really happens.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
  • 4Secret leak
    canary-leak
    Plants a fake secret and checks whether it leaks.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against
  • 5Internal addresses
    ssrf
    Checks whether a tool can be steered to internal addresses.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
  • 6Unconfirmed changes
    write-without-confirmation
    Checks whether tools that change data act without asking.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
  • 7Bad input
    error-handling
    Sends bad input and watches how the server answers.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
  • 8Model requests
    sampling
    Checks whether the server asks the client's model to act for it.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against
  • 9Sensitive questions
    elicitation-sensitive-data
    Checks whether the server asks users for sensitive data.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against
  • 10Folder boundary
    root-boundary
    Checks whether the server reaches outside the folders it was given.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
  • 11Log leaks
    logging-side-channel
    Checks whether log messages carry data they should not.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against
  • 13Fake assistant turns
    fake-assistant-turn
    Checks prompts that pose as the assistant's own words.The server returned an error when its prompts were read.not run · an error was returned
  • 16Sign-in redirect
    open-redirect
    Checks the sign-in redirect for abuse.Testing the sign-in redirect means sending probes to the operator's sign-in service, which we do not do.not run · our policy
  • 17Consent handling
    confused-deputy
    Checks consent handling when one service acts for another.Depends on the operator's own consent screen, which differs per server and cannot be tested from outside.not testable from outside
Does not apply to this server · 2
  • 14Token passthrough
    token-passthrough
    Checks whether the server forwards a user's token to other services.The server opened a session without sign-in, so there is no token flow to check.not applicable
  • 15Token audience
    token-audience-validation
    Checks whether tokens meant for another service are accepted.The server opened a session without sign-in, so there is no token flow to check.not applicable

Source: our own test, 2026-10-26, mcp-runtime-engine@0.1.0. Which checks count and why follows our published scoring model.

What happened during the test?

Feature #8

The steps in order, as the test record holds them.

  1. 0 msStarted a read-only session with the server's remote endpoint
  2. 2,494 msConnected after 0 redirects. No credential was sent or needed.
  3. Read the inventory: 87 tools, 9 resources, 7 prompts.
  4. 10,210 msFinished: 4 checks exercised.

Reference

How is it classified?

18 fields

One value per field, each with its source. Fields written by AI models are marked. A field with no value says why.

TopicAI-classified
pending: added in the weekly update
listed 2026-10-26; not classified yet
Pricing modelAI-classified
pending: added in the weekly update
the website is not read yet
Programming language
does not apply
no existing GitHub repository (server declares no repository link, so there is nothing to fetch)
Hosting type
registry · 2026-10-26
MCP capability
prompts, resources, tools
our test · 2026-10-26
Transport
streamable HTTP
registry · 2026-10-26
Required credentials
none declared
registry · no declaration is not a guarantee
Package registry
does not apply
remote-only server: no package is shipped, so there is no package registry
Freshness
0–30 days
registry updatedAt · 2026-10-26
Lifecycle status
registry · 2026-10-26
License class
does not apply
remote-only server: ships no package, so there is nothing to look up in a package registry
Integrity hash
does not apply
remote-only server: ships no package, so there is nothing to look up in a package registry
Signature / provenance
does not apply
remote-only server: ships no package, so there is nothing to look up in a package registry
Dependency advisories
does not apply
ships no package, so there are no dependencies to audit
Popularity
does not apply
remote-only server: ships no package, so there is nothing to look up in a package registry
Publisher signals
not stated
no readable GitHub owner to describe
Maintenance
does not apply
server declares no repository link, so there is nothing to fetch
Environment
the publisher's infrastructure
where it runs, from the hosting type

“Not stated” means the source did not state it; “does not apply” means it does not apply to this kind of server; “our limit” means our own lookup failed. A linked value opens the directory filtered to the same value.

Cite or correct this page

Sources and corrections

Suggested citation

ProtocolProbe. “com.usespur/spur: MCP server record.” Data checked 2026-10-26. https://protocolprobe.com/mcp/servers/com.usespur/spur

Figures are valid for the date shown. Our facts on this page are CC BY 4.0: reuse them with a link and the check date. Quoted text (the publisher’s descriptions, website quotes, tool names) is not ours to license.

As JSON: this record in the API · API documentation.

Badge for your README

ProtocolProbe: 1 of 2 record checks met

[![ProtocolProbe](https://protocolprobe.com/api/v1/badge/com.usespur/spur)](https://protocolprobe.com/mcp/servers/com.usespur/spur)

It shows this server's record-check count: facts from public records, no tool called. It is not a security rating or a pass. It links here and updates after each data reload.

Something wrong, or is this yours?

If a fact here is wrong, tell us and we will re-check it. If you operate this server, you can run our checks on it yourself with the free self-test command; we call no server’s tools ourselves for anything shown here.

Write to hello@protocolprobe.com · corrections log · methodology