MCP server for StealthSurf VPN API that provides tools for managing VPN configs, cloud servers, proxies, subscriptions, profiles, and custom VPN services.
StealthSurf MCP server demonstrates solid foundational quality with consistent naming patterns, documented descriptions, and structured schemas across all 6 tools. Tool names follow verb_noun convention (cloud_servers_list, cloud_servers_get_stats, cloud_servers_reboot, etc.), aligning well with agent expectations. All tools have substantive descriptions (100-200 chars range, exceeding the baseline average of 194 chars). Input schemas are present and typed using Zod with parameter descriptions. However, there are notable gaps: output schemas are not documented anywhere in the code (critical for agentic composition), error handling lacks guidance for recovery, tool annotations (readOnlyHint/destructiveHint/idempotentHint) are applied but not consistently used across all tools, and some parameters have loose constraints (e.g., 'promocode' accepts 4-32 chars but no validation pattern is visible). The codebase shows evidence of thoughtful design (e.g., the setup-cloud-server prompt demonstrates multi-step orchestration), but production-grade agentic tooling requires explicit output documentation and more granular error handling.
Order a new dedicated cloud server (VPS). Requires location_id from locations_list. Server is provisioned automatically after payment. Status starts as 'ordered' and becomes 'active' when ready. Cloud servers allow creating multiple VPN configs and proxies on one dedicated IP.
Get real-time statistics for a cloud server. Returns: host IP, status, uptime_days, cpu_model, and historical stats array with date, cpu%, ram%, upload/download Mbps. Use to monitor server health and performance.
List all user cloud servers (dedicated VPS instances). Returns array with: id, location_id, status ('ordered'|'active'), expires_at, url (IP/domain like 123-45-67-89.stealthsurf.app), is_online, auto_renewal, hostname. Cloud servers are personal VPS with full control over configs and proxies.
Reboot a cloud server. Use when server is unresponsive or after config changes that require restart. The server will be briefly offline during reboot.
Renew a cloud server subscription to extend expiration. Same parameters as create_order. If balance sufficient, renews immediately.
Output schemas are not documented. Tools return API responses but there is no documentation of response fields, types, or structure for agents to reason about downstream operations. This prevents confident tool chaining and forces agents to guess about available fields.
Error handling lacks recovery guidance. The code shows try-catch blocks that call toolError(e), but the error messages are not visible in source and appear to be raw API errors. Agents need 'what to do next' guidance (retryable vs user-fixable vs fatal, and suggestions for self-correction).
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | C | 67 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 26 | - | v1 |
Enable or disable auto-renewal for a cloud server. When enabled, renews from user balance before expiration. Requires 'days' parameter when enabling.
Parameter constraints are loose. 'promocode' description says '4-32 chars' but no regex pattern is enforced. 'hostname' says 'max 255 chars' but no length validation is visible. Constraints should be declared as JSON Schema minLength/maxLength/pattern, not just in descriptions.
Irreversible operations (create_order, renew) lack confirmation/dry-run. Agents can accidentally order expensive VPS instances without a confirm-before-execute pattern. The tool descriptions warn about cost but do not offer a safety gate.
Tool annotations present but incomplete. The code uses 'annotations.readOnly' for list/get/stats tools, but cloud_servers_reboot and cloud_servers_toggle_auto_renewal do not show explicit destructiveHint/writeHint annotations in the visible code snippet. Consistent annotation across all tools strengthens agent safety.
Parameter relationships undocumented. The 'days' parameter in cloud_servers_toggle_auto_renewal is 'Required when enabling' but this conditional dependency is not formally stated. A parameter cannot be conditionally required in JSON Schema; the description warns the LLM but does not enforce it.
create_order and renew both accept 'payment_method_id' but no guidance on how to obtain valid IDs. The description assumes the user knows how to get a payment method ID. If there is a list_payment_methods tool, reference it; otherwise document the lookup flow.