# Starcovery

> MCP tools to find and hire Instagram and TikTok creators from a plain-language brief.

- name: com.starcovery/mcp
- version: 1.0.0
- connection class: R0 (autonomous)
- trust: 83/100 flags: no-repository
- quality: 70/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/com.starcovery%2Fmcp
- tools: https://api.protogrid.dev/v1/servers/com.starcovery%2Fmcp/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "starcovery": {
      "type": "http",
      "url": "https://www.starcovery.com/api/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 100
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-100% +updated-14d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 70/100 (needs work)

### protocol: 88 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- warn `protocol.list_ttl`: tools/list declares ttlMs 0, so clients re-fetch it on every use

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 79 (weight 30)

- pass `tools.descriptions`: every tool has a description
- warn `tools.description_length`: 4 tools have descriptions over 1,024 characters, which crowds the context
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 28 of 28 tools declare readOnlyHint or destructiveHint
- warn `tools.directory_hints`: 6 of 28 tools declare all four hints; missing: enrich_creators (idempotentHint); list_campaigns (idempotentHint); get_campaign (idempotentHint); …
- warn `tools.token_cost`: about 13,395 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 25 (weight 15)

- warn `stability.changes`: 86 tool changes in 30 days
- fail `stability.rug_pull`: 1 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 28, about 13,395 tokens to load them all
- tool set hash: 92750b995f62c8bd6d4dcb918fca95bd
- tools last changed: 2026-10-20T10:15:59.959Z
- badge: [![protogrid quality](https://protogrid.dev/badge/com.starcovery/mcp.svg)](https://protogrid.dev/servers/com.starcovery/mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-20 `save_list` changed (inputSchema)
- 2026-10-20 `generate_campaign_matches` changed (inputSchema)
- 2026-10-20 `search_creators` changed (inputSchema, outputSchema)
- 2026-10-19 `update_campaign` changed (inputSchema)
- 2026-10-19 `create_campaign` changed (description, inputSchema)
  - before: Create a campaign with a goal (what to advertise or attain). A campaign is public and free by default; setting visibility "private" costs 1 credit. Contract (deliverable, compensationCents, and platforms, the platforms one payment covers), creator posting date, campaign details declassifying date (embargoUntil), disclosure, and marketInformation are accepted. Optional creators, each a profileId and fitScore pick, adds them as manual matches in the same call, as add_campaign_matches does, and the result carries matches with the added and present counts; any other key on a creator fails the call with a validation error; a creator id outside the catalog fails the call before anything is created or charged. Needs a credential.
  - after: Create a campaign with a goal (what to advertise or attain). A campaign opens only to its organization until its proposals are sent, at no charge. It is public and free by default, which opens it to any identified caller once sent; setting visibility "private" costs 1 credit and keeps it to the organization after the send. Contract (deliverable, compensationCents, and platforms, the platforms one payment covers), creator posting date, campaign details declassifying date (embargoUntil), disclosure, and marketInformation are accepted. Optional creators, each a profileId and fitScore pick, adds them as manual matches in the same call, as add_campaign_matches does, and the result carries matches with the added and present counts; any other key on a creator fails the call with a validation error; a creator id outside the catalog fails the call before anything is created or charged. Needs a credential.
- 2026-10-19 `get_campaign` changed (description)
  - before: Get one campaign and its matched creators. Ordinary public campaigns are free to read for any identified caller. A private campaign reads as not found for a caller outside the organization. Contract, creator posting date, campaign details declassifying date, and disclosure are present for members of the organization and may be null on open and summary reads. For members of the organization, people lists each person on the campaign once, with their profiles, their answer to the proposal, their funding (requested or funded), and their signed hire with the payout amount, paidAt (null while the payout is pending), and posts, each live post Starcovery recorded with its link, viewCount, and engagementCount (likes plus comments); people also lists a hire that matches no creator on the campaign, and is null for other callers. Hires and payouts are counted in people. For members of the organization, nextStep names the step the web app shows next, as list_campaigns does; it is null for other callers and once no step is left. currentSteps lists every step under way in campaign order in the same shape, because a step before nextStep can still wait, such as proposals Starcovery has not sent; currentSteps, not nextStep or status, tells whether a step is finished. It is null for other callers and empty once no step is left. Needs a credential.
  - after: Get one campaign and its matched creators. Ordinary public campaigns whose proposals are sent are free to read for any identified caller. A private campaign, and any campaign whose proposals are not yet sent, reads as not found for a caller outside the organization. Contract, creator posting date, campaign details declassifying date, and disclosure are present for members of the organization and may be null on open and summary reads. For members of the organization, people lists each person on the campaign once, with their profiles, their answer to the proposal, their funding (requested or funded), and their signed hire with the payout amount, paidAt (null while the payout is pending), and posts, each live post Starcovery recorded with its link, viewCount, and engagementCount (likes plus comments); people also lists a hire that matches no creator on the campaign, and is null for other callers. Hires and payouts are counted in people. For members of the organization, nextStep names the step the web app shows next, as list_campaigns does; it is null for other callers and once no step is left. currentSteps lists every step under way in campaign order in the same shape, because a step before nextStep can still wait, such as proposals Starcovery has not sent; currentSteps, not nextStep or status, tells whether a step is finished. It is null for other callers and empty once no step is left. Needs a credential.
- 2026-10-18 `enrich_creators` changed (inputSchema)
- 2026-10-18 `search_creators` changed (outputSchema)
- 2026-10-18 `fund_campaign` removed
  - Request campaign funding for a campaign the caller's organization owns. Starcovery Payouts runs concierge: this call records one open funding request for the accepted creators not yet funded, per person, with the quoted total (compensation per creator times those people, plus the platform fee that the market information answer sets), and notifies the Starcovery team, who invoice the organization. Only organization owners and admins may call it. Needs a saved contract, an answered market information question, and at least one creator who accepted and is not yet funded. Returns a tool error naming the reason when the campaign is not the caller's, it is archived, a step is missing, or a request is already open. An archived campaign is funded only after it is reopened with update_campaign status active. The reason creators_changed means a creator accepted while the request was prepared; the same call then succeeds. Returns the request row with amountCents set to the quoted total. Needs a credential.
- 2026-10-18 `send_campaign` removed
  - Request a proposal send for a draft campaign the caller's organization owns. Starcovery Proposals runs concierge: this call records one open send request and notifies the Starcovery team, who send the proposals from the staff queue. Needs a saved contract whose creator posting date, when set, is today or a later day in UTC, a captured disclosure, and at least one match. Returns a tool error naming the reason when the campaign is not the caller's, a step is missing, a request is already open, or the campaign is already sent. Returns the request row. Needs a credential.

Full history: https://api.protogrid.dev/v1/servers/com.starcovery%2Fmcp/changes

## Remotes

- https://www.starcovery.com/api/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (28)

- `add_campaign_match`: Add a creator as a manual match to a campaign by profileId, with its fitScore. Idempotent on (campaign, profileId). Stores the platform, handle, name, picture, and follower count of the catalog profile, so the input carries nothing else, and any other key, platform or username included, fails the call with a validation error; a profileId with no catalog profile returns not_found. While a send request is open, once the campaign is sent, or while it is archived, it returns a tool error naming the reason. Needs a credential.
- `add_campaign_matches`: Add several creators as manual matches to a campaign in one call. Each creator is a profileId and fitScore pick: the id and fitScore of a search_creators creator, or the profileId and fitScore of a get_list creator. Idempotent on (campaign, profileId). Stores the platform, handle, name, picture, and follower count of each catalog profile, so a creator carries nothing else, and any other key on a creator fails the call with a validation error. A profileId outside the catalog fails the call with a tool error naming it, and nothing is added. Returns added, the count of new matches, and present, the count already on the campaign, with addedCreators and presentCreators, the same counts per person, so a person with two matched profiles counts once. A campaign outside the caller's organization returns not_found. While a send request is open, once the campaign is sent, or while it is archived, it returns a tool error naming the reason. Needs a credential.
- `create_api_key`: Mint a new API key. Returns the plaintext key once; it is not shown again. The new key is an ordinary key of the same member, not a child of the minting key: revoking the minting key leaves it working. Needs a credential other than an agent access token or an OAuth access token.
- `create_campaign`: Create a campaign with a goal (what to advertise or attain). A campaign opens only to its organization until its proposals are sent, at no charge. It is public and free by default, which opens it to any identified caller once sent; setting visibility "private" costs 1 credit and keeps it to the organization after the send. Contract (deliverable, compensationCents, and platforms, the platforms one payment covers), creator posting date, campaign details declassifying date (embargoUntil), disclosure, and marketInformation are accepted. Optional creators, each a profileId and fitScore pick, adds them as manual matches in the same call, as add_campaign_matches does, and the result carries matches with the added and present counts; any other key on a creator fails the call with a validation error; a creator id outside the catalog fails the call before anything is created or charged. Needs a credential.
- `delete_campaign`: Delete a campaign and its matches. A funded campaign, a campaign with a signed hire, or a campaign with a proposal delivery returns a tool error naming the reason. Needs a credential.
- `delete_campaign_attachment`: Delete one file attached to a campaign of the caller's organization. Irreversible. An attachment or a campaign outside the caller's organization returns not_found. Needs a credential.
- `delete_list`: Delete one List of the caller's organization and its saved creators. Campaigns keep the creators added from it. Irreversible. A List outside the caller's organization returns not_found. Needs a credential.
- `enrich_creators`: Run shortlist AI enrichment (niche, celebrity, evidence, signal) for creators from search_creators. It takes the same creators array, query string (search query.q), and the shortlistId search_creators returned with them. Returns one analysis object per creatorId. A shortlistId works once, for 4 hours, and only for the caller who searched; enrichment spends no credits. Holds the call open until the result, up to 800 seconds.
- `export_campaign`: Export a campaign as CSV (Rank, Handle, Name, Platform, Followers, Fit, Source). Same access as get_campaign. Needs a credential.
- `generate_campaign_matches`: Generate creator matches from the campaign goal. Runs one creator search (same daily grant and prepaid credits as search_creators; pre-claim agent tokens spend prepaid credits only) and saves matches; idempotent on (campaign, profileId). Optional filters narrow the search. Holds the call open until the result, up to 800 seconds. While a send request is open, once the campaign is sent, or while it is archived, it returns a tool error naming the reason before any search runs. Needs a credential.
- `get_campaign`: Get one campaign and its matched creators. Ordinary public campaigns whose proposals are sent are free to read for any identified caller. A private campaign, and any campaign whose proposals are not yet sent, reads as not found for a caller outside the organization. Contract, creator posting date, campaign details declassifying date, and disclosure are present for members of the organization and may be null on open and summary reads. For members of the organization, people lists each person on the campaign once, with their profiles, their answer to the proposal, their funding (requested or funded), and their signed hire with the payout amount, paidAt (null while the payout is pending), and posts, each live post Starcovery recorded with its link, viewCount, and engagementCount (likes plus comments); people also lists a hire that matches no creator on the campaign, and is null for other callers. Hires and payouts are counted in people. For members of the organization, nextStep names the step the web app shows next, as list_campaigns does; it is null for other callers and once no step is left. currentSteps lists every step under way in campaign order in the same shape, because a step before nextStep can still wait, such as proposals Starcovery has not sent; currentSteps, not nextStep or status, tells whether a step is finished. It is null for other callers and empty once no step is left. Needs a credential.
- `get_credits`: Read the prepaid credit balance, the identified daily search grant status, and whether a card is on file. Does not start checkout or change payment settings. Needs a credential.
- `get_list`: Get one List of the caller's organization with its brief, filters, and saved creators, best fit first. The creators carry the saved creator shape that intersect_lists takes. add_campaign_matches, create_campaign, and save_list take only the profileId and fitScore of each. A List outside the caller's organization returns not_found. Needs a credential.
- `intersect_lists`: Keep the creators that appear in both lists, in the order of the left list. Nothing is stored. A search_creators result maps to the saved creator shape: profileId is the creator id, and fitScore, followerCount, name, platform, profileImageUrl, and username carry over. Needs a credential.
- `list_api_keys`: List API keys for the active organization (id, name, prefix, timestamps). An owner or admin sees every key; a member sees only the keys they minted. Never returns plaintext keys. Needs a credential other than an agent access token or an OAuth access token.
- `list_campaign_attachments`: List the files attached to a campaign of the caller's organization, with id, filename, content type, byte size, and upload time. Returns no file contents. A campaign outside the caller's organization returns not_found. Needs a credential.
- `list_campaigns`: List the caller's campaigns with goal, status, visibility, match counts, and nextStep: the step the web app shows next, with its id, label, actor (you for the organization, starcovery, creators, or one creator by name), and line, the sentence that says what the step waits on. nextStep is null once no step is left: the campaign is done or archived, or no creator was reached or accepted. Needs a credential.
- `list_lists`: List the organization's saved Lists with brief, filters, creatorCount (each person once), itemCount (each saved profile), and last update. Needs a credential.
- `remove_campaign_match`: Remove one matched creator from a campaign by match id. A match that already has a proposal delivery, or any match while a send request is open, once the campaign is sent, or while it is archived, returns a tool error naming the reason. Needs a credential.
- `request_campaign_funding`: Request campaign funding for a campaign the caller's organization owns. Starcovery Payouts runs concierge: this call records one open funding request for the accepted creators not yet funded, per person, with the quoted total (compensation per creator times those people, plus the platform fee that the market information answer sets), and notifies the Starcovery team, who invoice the organization.

Only organization owners and admins may call it. Needs a saved contract, an answered market information question, and at least one creator who accepted and is not yet funded. Returns a tool error naming the reason when the campaign is not the caller's, it is archived, a step is missing, or a request is already open. An archived campaign is funded only after it is reopened with update_campaign status active. The reason creators_changed means a creator accepted while the request was prepared; the same call then succeeds.

Returns the request row with amountCents set to the quoted total. Needs a credential.
- `request_campaign_send`: Request a proposal send for a draft campaign the caller's organization owns. Starcovery Proposals runs concierge: this call records one open send request and notifies the Starcovery team, who send the proposals from the staff queue.

Needs a saved contract whose creator posting date, when set, is today or a later day in UTC, a captured disclosure, and at least one match. Returns a tool error naming the reason when the campaign is not the caller's, a step is missing, a request is already open, or the campaign is already sent. Returns the request row. Needs a credential.
- `reveal_contact`: Reveal a creator contact address. Costs 1 prepaid credit the first time this organization reveals that profile. Later calls return the address without charging. Needs a credential.
- `revoke_api_key`: Revoke an API key by id. An owner or admin revokes any key of the organization; a member revokes only a key they minted, and another key returns not_found. Irreversible, and touches only that key: keys minted with it stay enabled until revoked by id. Needs a credential other than an agent access token or an OAuth access token.
- `save_list`: Save a set of creators as a List for the organization, with the brief and filters of the search that produced it. The List takes the name in name, or a name cut from the brief when name is omitted, with a number from 2 appended when another List of the organization holds that name. Each creator is a profileId and fitScore pick: profileId is the creator id from search_creators, and fitScore its fit. The List stores the platform, handle, name, picture, and follower count of each catalog profile, so a creator carries nothing else, and any other key on a creator fails the call with a validation error. A profileId outside the catalog fails the call with a tool error naming it, and no List is saved. Returns the saved List summary. Needs a credential.
- `search_creators`: Search Instagram and TikTok creators with a natural-language brief. Returns up to 50 ranked creators with fit score, follower count, platform, the 3 best-matching videos, and a shortlistId for enrich_creators when available. Bios and captions are cut to 150 characters. The creator's website link is returned as written, or null when it is longer than 200 characters. Every other link is a short link that redirects for 24 hours. When the result would pass 140,000 characters, the lowest ranked creators are left out until it fits. The brief in q sets no filter; platform, country, and tier filter. Contact addresses stay empty until reveal_contact. Holds the call open until the result, up to 800 seconds.

Each search is one use. Unsigned callers get 100 uses per rolling 24 hours per IP. Identified callers get 200 uses per rolling 24 hours, then prepaid credits. Pre-claim agent tokens skip the daily grant and use prepaid credits only.

enrich_creators takes these creators, query.q, and shortlistId for niche, evidence, and signal analysis.
- `thread_turn`: Run the next turn of a search thread and return the settled brief, its filters, the operations the turn ran, the reply, and the creators of the thread result set with a shortlistId for enrich_creators. creatorCount counts the whole set; creators holds at most the 50 best fit of them, fewer when the result would pass 140,000 characters. The reply, statement, and error are cut to 4,000 characters, and operations lists at most the first 20. Without threadId the call opens a new thread; the threadId in the result is the durable handle for the next turn. A pasted website address is read into a brief; anything else refines the brief, or answers a question about the organization's campaigns, Lists, credits, or API keys from read tools without changing them.

Sends notifications/progress when the caller passes a progressToken. MCP cannot stream a tool result, so the call is blocking and waits until the turn ends, up to 800 seconds.

Each turn costs 1 use plus 1 for each search and each exclusion it runs, from the same daily grant as search_creators and then 1 prepaid credit each. A refinement returns the set it built; the first brief runs one search for its creators, billed like search_creators. The thread stores the set, so reading it again with GET /api/threads/{threadId}/results is free. When the allowance runs out, exhausted is set and creators is empty; a turn that finds it spent runs nothing. Needs a credential.
- `update_campaign`: Update campaign fields: name, goal, visibility, or status (draft, archived, or active; Starcovery sets active when the team sends the proposals, and active reopens an archived campaign whose proposals were sent). A campaign that is active or holds a delivery cannot return to draft, a campaign with an open send or funding request cannot be archived, and a campaign that is not archived or was never sent cannot be set active; each change returns a tool error naming the reason. Changing visibility to private costs 1 credit; already-private updates do not. Contract (deliverable, compensationCents, and platforms, the platforms one payment covers), creator posting date, campaign details declassifying date (embargoUntil), disclosure, and marketInformation are accepted. Null marketInformation clears it. While a funding request is open or the campaign holds funds, a changed or cleared marketInformation returns a tool error naming the reason; a campaign whose reserve was refunded to zero takes a new answer. After Starcovery sends the proposals, a changed or cleared contract returns a tool error naming the reason, and a call without contract still changes the other fields. Needs a credential.
- `whoami`: Show the current credential, the bound user and organization, and whether the next search draws from the user daily grant or the organization balance. Needs a credential.