Heista Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Heista Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The Heista MCP server. Decode any video ad. Load any brand. Generate scripts. From inside Claude, ChatGPT, Cursor, VS Code, and any other MCP-compatible client.
Endpoint: https://www.heista.co/api/mcp/mcp Transport: Streamable HTTP (MCP protocol 2025-03-26) Auth: OAuth 2.1 (preferred) or API key (Authorization: Bearer hst_live_*) Status: Live
| Tool | What it does | Cost |
|---|---|---|
decode_ad | Decode any video ad URL into structural formula, hooks, psychology, visual playbook | $0.15 (≤60s) / $0.20 (61–120s) |
get_decode | Poll for decode result | Free |
create_powersource_url | Load a brand from a website URL | $1.00 |
create_powersource_docs | Load a brand from internal documents (PDF, DOCX, briefs) | $1.00 |
create_powersource_full | Load a brand from URL + documents combined | $2.00 |
get_powersource | Poll for brand load result | Free |
generate_adscript | Generate ad scripts from a decoded ad or formula, in any brand's voice | ~$0.02–$0.05 per script |
get_hook_intelligence | Read proven hook patterns from the decoded corpus | Free |
adformula_intelligence | Read clustered ad formulas from decoded winners | Free |
decoder_intelligence | Read decoded ads from the corpus | Free |
check_balance | Check your account balance and monthly usage | Free |
Same-domain re-runs of create_powersource_* by the same org are free. Decodes already in your library are free. Failed runs cost nothing.
Full reference, schemas, examples: heista.co/docs.
claude mcp add heista https://www.heista.co/api/mcp/mcpOr install via plugin marketplace:
/plugin marketplace add Heista-co/claude-code-skills
/plugin install heista-decode@heista-skillsPer-client snippets: clients/.
OAuth 2.1 is the default. First call returns 401 + WWW-Authenticate: Bearer with RFC 9728 Protected Resource Metadata. MCP clients follow the chain automatically and prompt the user to sign in.
For headless / server-to-server use, generate an API key at heista.co/api-console/keys and pass it as Authorization: Bearer hst_live_.... Keys are SHA-256 hashed at rest, shown in plaintext once, scoped per key, and capped per day/month.
Scopes:
mcp:account — balance, decode/powersource pollingmcp:intelligence — free corpus readsmcp:tools — paid generation (decode, powersource, adscript)mcp:tools is elevated via WWW-Authenticate scope=mcp:tools on first paid call.
Pay as you go, no subscription required. All paid calls reserve the maximum cost up front and refund any excess after.
Credit packs (1 credit = 1¢ USD):
| Pack | Price | Credits | Decode estimate |
|---|---|---|---|
| Starter | $10 | 1,000 | ~100 decodes |
| Builder ⭐ | $50 | 5,000 | ~500 decodes |
| Scale | $100 | 10,000 | ~1,000 decodes |
| Enterprise | $250 | 25,000 | ~2,500 decodes |
Buy at heista.co/api-console/billing.
Spending caps: set hourly / daily / monthly caps per organization and per key from heista.co/api-console/limits. The server enforces the cap before any compute runs.
A Heista account is required for paid tools. The free intelligence reads work after OAuth sign-in.
| Resource | Link |
|---|---|
| Full API & MCP docs | heista.co/docs |
| OpenAPI spec | heista.co/openapi.yaml |
| Tool schemas (this repo) | tools/ |
| Worked examples | examples/ |
| Per-client install | clients/ |
| Registry manifest | server.json |
| OAuth metadata | /.well-known/oauth-protected-resource |
| Claude Code skills | github.com/Heista-co/claude-code-skills |
| Status | heista.co |
| Support | [email protected] |
Docs in this repo are MIT-licensed (see LICENSE). The Heista MCP server itself runs under heista.co/terms.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.