Spacefast MCP (official, remote)

65/100

Capped at 65: vendor-hosted, source not published. The tests add up to 75.

Last tested 2026-11-10 (Fresh: tested within 30 days) Needs credentialsNo tool call tested yet OAuth

Advisories: not checked (remote-only)

Security review: not tested

Test points add up to 75; the score is capped at 65 (vendor-hosted, source not published). Not a quality or security rating. Capped listings are not promoted in our rankings or on the homepage. Why scores are capped

Test points before the cap (75/100)

  • Install20/20
  • Handshake5/30
  • Maintenance25/25
  • Docs15/15
  • License10/10

Vendor-hosted
What we probed (2026-11-10 UTC, no credentials): an MCP initialize POST to https://mcp.spacefast.com returned HTTP 401 with an OAuth challenge (resource_metadata https://mcp.spacefast.com/.well-known/oauth-protected-resource), whose metadata lists authorization server https://api.spacefast.com/v1/auth. We did not sign in, so no tools were listed or called. Spacefast is Automattic's new hosting platform for AI-made sites and apps (launched Nov 9, 2026; TechCrunch and PR Newswire). Source/docs repo spacefast/mcp (MIT; 7 GitHub stars when tested); the local `sf mcp` server in npm spacefast 0.8.0 needs a CLI login or SPACEFAST_TOKEN, so it was not run. Anonymous publishing via the CLI was not tried (it would put content online). Score capped: no tool call. Already on Glama (Spacefast MCP by spacefast).
Claude Code 2.1.321 fixed MCP OAuth requests sending secrets such as refresh tokens to another host when a server redirected them. Claude Code changelog

Transport: Streamable HTTP · not tested

Token cost (estimate): the figure is pending. We have no tools/list capture to estimate from.

Permissions: tool permissions pending · Auth: OAuth · Rate limit: unknown · Pricing unit: unknown

Auth: OAuth. Rate limit: unknown. Pricing unit: unknown.

HTTP 401, WWW-Authenticate resource_metadata https://mcp.spacefast.com/.well-known/oauth-protected-resource, OAuth metadata lists authorization server https://api.spacefast.com/v1/auth

Existing test evidence only. We did not run a new OAuth sign-in or client compatibility test for this card. Claude Code changelog

Score 65/100 · Tools 0 · Token cost pending · Compare · Last tested 2026-11-10 · Server version not reported · Remote endpoint https://mcp.spacefast.com (streamable-http) · Repo spacefast/mcp

Summary: Spacefast MCP (official, remote) requires credentials or a backing service before it will list tools.

Evidence summary

Handshake
auth-gated
Tools listed
0
Context cost
Pending The token cost figure is pending. ranking
Login
Needs OAuth sign-in
Tested
2026-11-10

Test results

TestResultPointsEvidence
installpass20Endpoint https://mcp.spacefast.com reachable over streamable-http (HTTP 401) in 0.0s; no install step for remote servers.
handshakeauth-gated5Needs credentials: vendor-hosted, OAuth sign-in required. HTTP 401 with OAuth challenge (WWW-Authenticate resource_metadata https://mcp.spacefast.com/.well-known/oauth-protected-resource; metadata lists authorization server https://api.spacefast.com/v1/auth). We do not sign in; not counted as working until a credentialed test exists.
maintenancepass25Repo pushed 24 days before test; 7 GitHub stars.
docspass15README over 3,000 chars; install instructions present; mcpServers config example present. Check of the package's own README (vendor repo README (github.com/spacefast/mcp)).
licensepass10MIT (OSI-approved).

Local-model readiness

Not tested

Not yet tested (no tools/list response without credentials).

What we tested and what we didn't

Tested on 2026-11-10

  • Install from the registry (remote endpoint: connection only)
  • We attempted an MCP initialize with no credentials and got HTTP 401, so we never reached the tool list (Method details: initialize POST answered 401; tools/list not sent)
  • Maintenance signals (last push, archived/deprecated status)
  • Docs (README length, install and config example)
  • License (OSI-approved or not)
  • Token cost (estimate)

Not tested

  • Security: not audited (no code review, no permission or data-flow analysis)
  • Real tasks (no functional task runs yet)
  • Behaviour with real credentials or a real account
  • Performance, rate limits or load
  • Correctness of results beyond the listed tasks

Methodology: how we test. A high score means it installs and responds, not that giving it access to your data carries no risk.

Known security issues

Not checked (remote-only): hosted endpoint, version unknown.

Monthly roundup: MCP security issues, October 2026.

Tool list changes

No tool list: this server did not list tools without credentials in our test, so tool changes are not tracked.

Raw test record (JSON)
{
  "name": "spacefast-remote",
  "version": null,
  "registry": "remote",
  "status": "auth-gated",
  "tested": "2026-11-10",
  "tools_count": null,
  "deprecated": false,
  "archived": false,
  "tests": {
    "install": [
      "pass",
      20,
      "Endpoint https://mcp.spacefast.com reachable over streamable-http (HTTP 401) in 0.0s; no install step for remote servers."
    ],
    "handshake": [
      "auth-gated",
      5,
      "Needs credentials: vendor-hosted, OAuth sign-in required. HTTP 401 with OAuth challenge (WWW-Authenticate resource_metadata https://mcp.spacefast.com/.well-known/oauth-protected-resource; metadata lists authorization server https://api.spacefast.com/v1/auth). We do not sign in; not counted as working until a credentialed test exists."
    ],
    "maintenance": [
      "pass",
      25,
      "Repo pushed 24 days before test; 7 GitHub stars."
    ],
    "docs": [
      "pass",
      15,
      "README over 3,000 chars; install instructions present; `mcpServers` config example present. Check of the package's own README (vendor repo README (github.com/spacefast/mcp))."
    ],
    "license": [
      "pass",
      10,
      "MIT (OSI-approved)."
    ]
  }
}

Install

https://mcp.spacefast.com

Tools listed

Not available (handshake did not complete without credentials).

Quick config

{
  "mcpServers": {
    "spacefast-mcp-remote": {
      "type": "http",
      "url": "https://mcp.spacefast.com"
    }
  }
}

Add to config Opens the config generator with this server selected.

Setup

Without credentials it said (verbatim): Needs credentials: vendor-hosted, OAuth sign-in required. HTTP 401 with OAuth challenge (WWW-Authenticate resource_metadata https://mcp.spacefast.com/.well-known/oauth-protected-resource; metadata lists authorization server https://api.spacefast.com/v1/auth). We do not sign in; not counted as working until a credentialed test exists.

  1. Install. No install step: it is a remote server at https://mcp.spacefast.com.
  2. Configure. Add the mcpServers entry below to your MCP client config.
  3. Verify. Restart the client and check that tools/list returns tools. In our test it did not list tools without credentials.
{
  "mcpServers": {
    "spacefast-mcp-remote": {
      "type": "http",
      "url": "https://mcp.spacefast.com"
    }
  }
}

Not tested with credentials We have not tested this with real credentials.

Test history

Follow this server (RSS) · Monthly changelog

Related: Troubleshooting: 401 Unauthorized on remote servers · MCP servers that need an OAuth sign-in · How to protect AI API keys

FAQ

Is Spacefast MCP deprecated?

No. spacefast-remote was not deprecated or archived when we last tested it on 2026-11-10.

What replaces Spacefast MCP?

Nothing; Spacefast MCP (official, remote) is not deprecated as of 2026-11-10.

Does Spacefast MCP need an API key?

Not an API key: it needs an OAuth sign-in. Without signing in, the endpoint returned HTTP 401 with an OAuth challenge and did not list tools.

Embed the badge

TestedMCP: 65/100, tested 2026-11-10

Every tested server gets a free embeddable badge. It shows the current score and test date and expires after 90 days. Testing is free; payment never changes a score.

Claim this listing · Report an issue