MCP.Market

Xfa MCP server

online · 100% uptime
by xfa.tech·tech.xfa/xfa·v0.1.2
No reviews yet

XFA's remote MCP server — query device posture, compliance, policies & CVEs. Read-only.

A92/100grade A
Write a reviewRun it
What users say
No reviews yet
Be the first
Safety scan
A92/100

full report

Adoption
New

0 stars

Reviews

Write one

Nobody has reviewed Xfa yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Xfa tools

Tool list not cached yet. `describe` through the gateway fetches it live.

Public scan report

scanner v0.1.10 · 2026-11-01 · same rubric, same numbers if you re-run it

no findings
  • –Code scanremote-only server, no package to scann/a
  • Live reliabilityremote reachable in 551ms (auth required)20/20
  • –Tool poisoningtools not inspected (endpoint requires auth); not countedn/a
  • Auth qualityOAuth resource metadata advertised on 40115/15
  • Maintenancelast push 55 days ago12/15
  • Maintainer identitynamespace and repository owner differ; GitHub account older than a year; website matches verified namespace8/10
Overall 92/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Xfa compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
92/100
higher than 95% of 48,255 servers
Uptime
100%
of our recent checks; the typical remote server answers 100%
Response time
543 ms
faster than 27% of 30,031 servers

Install Xfa in Claude Code, Cursor or VS Code

claude mcp add --transport http xfa https://mcp.xfa.tech/mcp
Add to Cursor

What the publisher says

From the Xfa repository's README, as published. We do not edit it. Read it on GitHub

XFA MCP

XFA is a BYOD device-trust platform. This is XFA's remote Model Context Protocol server — query your organization's device posture, compliance, policies, and software/CVE status from Claude, ChatGPT, Cursor, and other AI assistants. Read-only.

This repository is the connector package for AI marketplaces. The MCP server itself is hosted by XFA at https://mcp.xfa.tech/mcp; nothing runs locally. Authentication is OAuth 2.0 (PKCE) — you sign in with your XFA account on connect.

Where it's published

Legend: ✅ live · ⏳ propagating (no action) · 🕒 pending. Update a row when its listing goes live.

Gemini note: the Gemini CLI gallery has no submission form — it crawls public repos

tagged with the gemini-cli-extension GitHub topic daily (already set). Gemini CLI merged

into Antigravity CLI (June 2026); Antigravity discovers MCP servers via the MCP Registry,

where this server is already live, so no separate Antigravity submission is needed.

Install

Cursor

One-click:

cursor://anysphere.cursor-deeplink/mcp/install?name=xfa&config=eyJ1cmwiOiJodHRwczovL21jcC54ZmEudGVjaC9tY3AifQ==

Or add to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "xfa": { "url": "https://mcp.xfa.tech/mcp" }
  }
}

Claude

Settings → Connectors → Add custom connector → URL https://mcp.xfa.tech/mcp.

ChatGPT

Settings → Connectors → Add → MCP server URL https://mcp.xfa.tech/mcp.

Gemini CLI

Install the extension:

gemini extensions install https://github.com/gl-ventures/xfa-mcp

The bundled gemini-extension.json points at the remote server; Gemini discovers OAuth from the server metadata and prompts you to sign in on first use.

VS Code / Windsurf / Zed / other MCP clients

Point the client at the remote URL https://mcp.xfa.tech/mcp (streamable HTTP / SSE, OAuth 2.0).

Tools

All tools are read-only. The live server is the source of truth — clients fetch the current tool list from the endpoint on every connection, so this list may lag the deployed server. See the Connect an AI assistant docs for the maintained reference.

Your organization (scoped to the signed-in user's org)

Software & vulnerabilities (XFA's tracked-software catalog)

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Xfa: common questions

Is Xfa MCP server safe?
Yes, by our scan: it is graded A (92/100). Read the Xfa safety report
How do I install Xfa?
It runs remotely at mcp.xfa.tech. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
Does Xfa need an API key?
No key to paste: it signs you in with OAuth when your client connects.
Is Xfa maintained?
The last commit was 58 days ago (2026-09-07). The latest release is v0.1.2.
Is Xfa up?
100% of our last 28 checks got an answer. We check remote servers about four times a day.
How does Xfa compare with other MCP servers?
safety score 92/100 (higher than 95% of 48,255 servers); uptime 100% (of our recent checks; the typical remote server answers 100%); response time 543 ms (faster than 27% of 30,031 servers). Full comparison.