Xfa

tech.xfaPublished by xfa.techOfficial publisherv0.1.2Updated Oct 25, 2026

XFA's remote MCP server — query device posture, compliance, policies & CVEs. Read-only.

VerifiedStreamable HTTPWeb executableCloud & InfrastructureSecurity & Monitoring

Overview

AI-generated overview

XFA's remote, read-only MCP server that lets an AI assistant query your organization's device posture, compliance, policies and software CVE status.

What you can do
Look up your organization and the signed-in user, and list or fetch individual devices active in the last 30 days. Read org-wide compliance summaries and posture trends over time, and list policies. Browse XFA's tracked software catalog, check the latest known version of a product and the status of a specific version. Retrieve the CVEs affecting a given software version.
When to use it
Useful when you want an assistant to answer questions about your BYOD fleet's trust posture, compliance standing, policy set or vulnerability exposure without opening the XFA console. Suited to read-only reporting and investigation rather than changes.
Requirements
A remote endpoint at mcp.xfa.tech using streamable HTTP; nothing runs locally. An XFA account with OAuth 2.0 (PKCE) sign-in on connect, scope mcp:read. Network access to the endpoint.
Before you install
Sign-in grants the assistant read access to your organization's device, compliance and policy data, scoped to the signed-in user's org. All tools are read-only, so no data is changed, but posture and vulnerability details are sent to the AI client you connect. No API keys are stored in the connector package.

Installation

In SourceWeft

  1. Open Xfa in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/tech.xfa%2Fxfa/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "xfa": {
      "type": "http",
      "url": "https://mcp.xfa.tech/mcp"
    }
  }
}

README

XFA MCP

XFA is a BYOD device-trust platform. This is XFA's remote Model Context Protocol server — query your organization's device posture, compliance, policies, and software/CVE status from Claude, ChatGPT, Cursor, and other AI assistants. Read-only.

This repository is the connector package for AI marketplaces. The MCP server itself is hosted by XFA at https://mcp.xfa.tech/mcp; nothing runs locally. Authentication is OAuth 2.0 (PKCE) — you sign in with your XFA account on connect.

Where it's published

SurfaceStatusWhere to submit / find
Official MCP Registry✅ Livetech.xfa/xfa · registry.modelcontextprotocol.io
Glama⏳ Propagating from registryglama.ai/mcp/servers
Smithery⏳ Propagating from registrysmithery.ai
PulseMCP⏳ Propagating from registrypulsemcp.com
mcp.so⏳ Propagating from registrymcp.so
Cursor Marketplace🕒 Submitted — pending approvalcursor.com/marketplace/publish
Claude Connectors Directory✅ Liveclaude.ai/directory/mcp-xfa-tech
ChatGPT app directory✅ Livechatgpt.com/plugins/…
Gemini / Antigravity CLI✅ Installable · ⏳ gallery auto-crawlgemini-cli-extension topic set; also via the MCP Registry
awesome-mcp-servers🕒 PR open — #12739Security section

Legend: ✅ live · ⏳ propagating (no action) · 🕒 pending. Update a row when its listing goes live.

Gemini note: the Gemini CLI gallery has no submission form — it crawls public repos tagged with the gemini-cli-extension GitHub topic daily (already set). Gemini CLI merged into Antigravity CLI (June 2026); Antigravity discovers MCP servers via the MCP Registry, where this server is already live, so no separate Antigravity submission is needed.

Install

Cursor

One-click:

cursor://anysphere.cursor-deeplink/mcp/install?name=xfa&config=eyJ1cmwiOiJodHRwczovL21jcC54ZmEudGVjaC9tY3AifQ==

Or add to ~/.cursor/mcp.json:

json
{  "mcpServers": {    "xfa": { "url": "https://mcp.xfa.tech/mcp" }  }}

Claude

Settings → Connectors → Add custom connector → URL https://mcp.xfa.tech/mcp.

ChatGPT

Settings → Connectors → Add → MCP server URL https://mcp.xfa.tech/mcp.

Gemini CLI

Install the extension:

gemini extensions install https://github.com/gl-ventures/xfa-mcp

The bundled gemini-extension.json points at the remote server; Gemini discovers OAuth from the server metadata and prompts you to sign in on first use.

VS Code / Windsurf / Zed / other MCP clients

Point the client at the remote URL https://mcp.xfa.tech/mcp (streamable HTTP / SSE, OAuth 2.0).

Tools

All tools are read-only. The live server is the source of truth — clients fetch the current tool list from the endpoint on every connection, so this list may lag the deployed server. See the Connect an AI assistant docs for the maintained reference.

Your organization (scoped to the signed-in user's org)

ToolDescription
get_organizationGet your XFA organization
get_current_userGet the signed-in user
list_devicesList devices (active in the last 30 days)
get_deviceGet a single device
get_compliance_summaryOrg-wide compliance summary
get_posture_trendsPosture trends over time
list_policiesList policies

Software & vulnerabilities (XFA's tracked-software catalog)

ToolDescription
get_latest_versionLatest known version of a piece of software
list_versioned_software_catalogList the software XFA tracks
get_software_version_infoStatus of a specific software version
get_cves_for_versionCVEs affecting a software version

Authentication

OAuth 2.0 with PKCE (S256), scope mcp:read. On connect you are redirected to XFA to authorize; no API keys or tokens are stored in this package. The client auto-discovers the OAuth endpoints from the server's already-published metadata:

  • https://mcp.xfa.tech/.well-known/oauth-protected-resource
  • https://mcp.xfa.tech/.well-known/oauth-authorization-server

Support

Maintainers

The MCP Registry workflow validates server.json on every change and publishes to the official MCP Registry on pushes to main (or via Run workflow). It authenticates by DNS against the v=MCPv1 TXT record on the xfa.tech apex.

To release a new version: bump version in server.json, merge to main.

Required repo secret: MCP_REGISTRY_KEY_PEM — the Ed25519 private key PEM (pairs with the DNS TXT record). Keep the matching key backed up in a password manager.

License

MIT — see LICENSE.

Source: README.md at commit dfbb076

Tools

0
This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

1
  1. v0.1.2LatestSep 16, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts