QAmcp

Copied. Paste it into Claude Code, Cursor or Codex:Fetch and follow the instructions at https://qamcp.dev/setup.md to test my MCP server.

Your AI finds your server in your project, tests it with QAmcp, explains what's wrong in plain words, fixes it with your OK, and tests again. Read the instructions

SoonYour score can change any day. QAmcp Monitor tests your server every hour and emails you when it breaks.See what Monitor does →

Directory / Roster

Roster

Q: Is Roster MCP server safe?

QAmcp's test on 1 Nov 2026: None of the hidden-instruction wordings we know were found in its tool descriptions. Its error messages showed no secrets or internal details. 9 of its 23 tools are labeled read-only; the others may change or send things. Overall it scored 85/100 on 1 Nov 2026. A test can only see what the server shows from outside, not what it does with your data behind the scenes. Connect servers from makers you trust.

by roster-ivory-zeta.vercel.app · https://roster-ivory-zeta.vercel.app/api/mcp

Hire AI agents with distinct personalities for writing, marketing, research, legal and more.

23 tools✓ no account neededPricing: on their site

See pricing →Visit website

85 /100

PASS · WITH NOTES

13 of 13 checks · 1 Nov 2026

Is Roster MCP server safe?

None of the hidden-instruction wordings we know were found in its tool descriptions.
Its error messages showed no secrets or internal details.
9 of its 23 tools are labeled read-only; the others may change or send things.
Overall it scored 85/100 on 1 Nov 2026.

A test can only see what the server shows from outside, not what it does with your data behind the scenes. Connect servers from makers you trust.

What it can do

23 tools, in the server's own words.

search_agentsread-only

Find Roster agents for a task.

get_agentread-only

One agent's full public profile: bio, personality sliders, skills, scope, packages with prices and turnaround, and sample work titles.

get_sandbox_key

Get a free sandbox key right now, no account: POST /api/v1/access/sandbox (MCP get_sandbox_key) with optional {"agent_name"}.

request_access

Get a live key your human approves in one tap, without leaving your chat for more than a moment: POST /api/v1/access/request (MCP request_access) with optional…

check_access

Poll a request_access request every 5 seconds.

hire_agent

Hire an agent for one deliverable.

get_jobread-only

Check one job: status (running, completed or failed), package, price, payment record and webhook delivery.

get_job_resultread-only

The finished deliverable as markdown, once get_job says status is completed (before that: not_ready).

rate_job

After a job is completed: rate it 1-5 and leave feedback.

request_revision

Ask the agent to revise a completed job.

open_dispute

Tell Roster a job went wrong.

list_jobsread-only

Your key's jobs, newest first, 20 per page (limit 1-100).

get_usageread-only

Your key's usage today against its daily limits: jobs_today / job_limit, spend_today_usd / spend_limit_usd (live keys), and resets_at (midnight America/New_Yor…

set_usage_alert

Optional usage alerts: set an alert webhook on your key (PUT /api/v1/usage/alert {"webhook_url"}, MCP set_usage_alert, or your human on /account) and Roster PO…

list_webhook_deliveriesread-only

Every webhook Roster has sent (or tried to send) for your key, newest job first: job.started, job.completed / job.failed and usage.threshold.

redeliver_webhook

Send one delivery again: the same event (same id and body, so you can dedupe on id), freshly signed with the key's current webhook secret, to the URL it was fi…

test_webhook

Send one signed ping event to check your webhook endpoint and signature verification without hiring anyone.

get_webhook_eventsread-only

Which webhook events your key gets (events), which it doesn't (filtered_out), and every choice (available).

set_webhook_events

Choose which webhook events your key gets: job.started, job.completed, job.failed, usage.threshold.

get_job_webhookread-only

Your key's default webhook URL for job events (webhook_url, null when unset), and which job events it gets under your event filter (events, filtered_out).

set_job_webhook

Set a default webhook URL for your key's job events (job.started, job.completed, job.failed), so you don't have to send webhook_url with every job.

rotate_webhook_secret

Makes a new webhook signing secret for the API key making the call and returns it once.

revoke_key

Revokes the API key making the call, at once and for good: every later call with it gets 401 revoked_key.

Test results

Safe mode: only tools labeled read-only were run. How the test works

!
Ready for the newest MCP version
1 warning
- !Uses an older MCP version (2025-06-18). It works today, but it isn't on the July 2026 version (2026-07-28) yet.
note
!
Every tool is described
1 warning
- !search_agents: Inputs with no description: limit, offset
note
!
Resources and prompts work
2 warnings (60 resources, 1 template, 2 prompts)
- !hire_for_brief: Could not open it with sample inputs: Invalid params: department must be one of: Writing, Marketing & Sales, Admin & Ops, Support, Research & Data, Product & QA, HR & Recruiting…
- !compare_agents: Could not open it with sample inputs: Invalid params: agent_ids needs 2 to 5 different ids, comma-separated.
- and 3 more
note
✓
ConnectsConnected in 408 ms
pass
✓
Lists its toolsFound 23 tools
pass
✓
Tools are labeled safe or dangerousEvery tool has a safety label
pass
✓
No known hidden instructionsNone of the hidden-instruction wordings we know were found in tool descriptions. New wordings can get past this check.
pass
✓
Tools work with good inputs
All good
- ✓search_agents: Worked (110 ms)
- ✓get_agent: Answered with an error, probably because of our sample input: not_found: No agent with id "test". Use search_agents (there are 58). {"error":{"code":"not_found","message":"No agent with id \"test\". Us…
- ✓get_job: Answered with an error, probably because of our sample input: unauthorized: This tool needs an API key. Free sandbox key now (no account): call get_sandbox_key {"agent_name": "<your name>"}. Live key: …
- ✓get_job_result: Answered with an error, probably because of our sample input: unauthorized: This tool needs an API key. Free sandbox key now (no account): call get_sandbox_key {"agent_name": "<your name>"}. Live key: …
- ✓list_jobs: Answered with an error, probably because of our sample input: unauthorized: This tool needs an API key. Free sandbox key now (no account): call get_sandbox_key {"agent_name": "<your name>"}. Live key: …
- ✓get_usage: Answered with an error, probably because of our sample input: unauthorized: This tool needs an API key. Free sandbox key now (no account): call get_sandbox_key {"agent_name": "<your name>"}. Live key: …
- ✓list_webhook_deliveries: Answered with an error, probably because of our sample input: unauthorized: This tool needs an API key. Free sandbox key now (no account): call get_sandbox_key {"agent_name": "<your name>"}. Live key: …
- ✓get_webhook_events: Answered with an error, probably because of our sample input: unauthorized: This tool needs an API key. Free sandbox key now (no account): call get_sandbox_key {"agent_name": "<your name>"}. Live key: …
- and 15 more
pass
✓
Bad inputs give a clean error
All good
- ✓search_agents: Refused wrong type for "query" with a clear error
- ✓get_agent: Refused missing required input "agent_id" with a clear error
- ✓get_agent: Refused wrong type for "agent_id" with a clear error
- ✓get_job: Refused missing required input "job_id" with a clear error
- ✓get_job: Refused wrong type for "job_id" with a clear error
- ✓get_job_result: Refused missing required input "job_id" with a clear error
- ✓get_job_result: Refused wrong type for "job_id" with a clear error
- ✓list_jobs: Refused wrong type for "cursor" with a clear error
- and 4 more
pass
✓
Tools work togethersearch_agents → get_agent: get_agent found what search_agents returned (agent_id = "linda")
pass
✓
Fast enough
All good
- ✓Connecting took 408 ms
- ✓Listing tools took 107 ms
- ✓Average tool answer: 100 ms
- ✓search_agents: Slowest tool: search_agents (110 ms)
pass
✓
No secrets leakedChecked 35 error messages: no secrets or internal details
pass
✓
Follows MCP best practices (not scored yet)Tool names, safety labels and tool list size follow the MCP guide
pass

Test it yourself

Free and open source. Same checks, same score.

npx qamcp-cli https://roster-ivory-zeta.vercel.app/api/mcp

Show this score on GitHub

Free for every server in the directory. Paste this into your README: the badge shows the score from our latest test.

[![QAmcp score](https://qamcp.dev/s/app-vercel-roster-ivory-zeta-roster.svg)](https://qamcp.dev/s/app-vercel-roster-ivory-zeta-roster.html)

Score over time

1 Nov 202685

One test so far. New tests will show here.

Reviews

Coming soon: reviews from people who use Roster, signed in with GitHub, one per person. Reviews never change the score.

Is this your server? Get an alert the moment it breaks.

QAmcp Monitor (coming soon) tests it every hour and emails you when it goes down, the score drops, a tool changes or a secret leaks. You'll also be able to claim this page and get a verified owner mark. Founding price: $19/month for life for the first 50 teams.

Have a concern, or want it removed? Ask us and we'll take it off the list. How the directory works