Yes: Convex runs a public MCP server at mcp.convex.dev, found by guessing the subdomain, and it listed 4 tools to a client with no credentials on 4 November 2026. Examples: start_convex_app, add_convex_to_existing_project, get_convex_scaling_guidance. It speaks streamable-http, protocol 2025-06-18. A CLI is on record: convex on npm.
71, grade B; Ora scanned the domain on 11 October 2026 and the cached score was read on 5 November 2026 from its score API (Ora's score page for convex.dev, a vendor-published score)
Company found through
the vendor's own documentation
Last verified
4 November 2026
MCP server
Endpoint
https://mcp.convex.dev/mcp
How it was found
endpoint found by subdomain guess, verified by connecting
2 connections on 4 November 2026, read-only methods only
19:57:01Z https://mcp.convex.dev/mcp sent initialize, notifications/initialized, tools/list result verified (HTTP 200) 933 ms
20:02:33Z https://mcp.convex.dev/mcp sent initialize, notifications/initialized, tools/list result verified (HTTP 200) 1018 ms
Authentication
Auth type
No authentication
The sign-in route, step by step
Send the handshake to https://mcp.convex.dev/mcp over streamable-http. Servers on the 2026-07-28 revision answer server/discover; older servers answer initialize.
Send tools/list, then resources/list and prompts/list if the capabilities name them.
Send no token. The connector sent none and the server answered, so any MCP client can read this list.
Calling a tool is a separate step this directory never takes.