Xfa

tech.xfa由 xfa.tech 發布官方發布者v0.1.2更新於 Oct 25, 2026

XFA's remote MCP server — query device posture, compliance, policies & CVEs. Read-only.

已驗證Streamable HTTP可網頁執行雲端與基礎設施安全與監控

概覽

AI 產生的概覽

XFA 的遠端唯讀 MCP 伺服器，讓 AI 助理查詢所屬組織的裝置安全態勢、合規狀況、原則以及軟體 CVE 狀態。

可以做什麼
查詢組織資訊與目前登入的使用者，列出或取得近 30 天內活躍的單一裝置。讀取組織層級的合規摘要與態勢趨勢，並列出原則。瀏覽 XFA 追蹤的軟體目錄，查詢某軟體的最新已知版本及特定版本的狀態。取得影響指定軟體版本的 CVE。
適用情境
適合讓助理在不開啟 XFA 主控台的情況下，回答關於 BYOD 裝置信任態勢、合規情形、原則集合或漏洞暴露的問題。適用於唯讀的報告與排查，而非變更操作。
執行需求
遠端端點 mcp.xfa.tech，使用 streamable HTTP，本機不執行任何程式。需要 XFA 帳號，連線時透過 OAuth 2.0（PKCE）登入，權限範圍為 mcp:read。需要能連線至該端點的網路。
安裝前請注意
登入後助理可讀取你所屬組織的裝置、合規與原則資料，範圍限於登入使用者所屬組織。所有工具皆為唯讀，不會修改資料，但態勢與漏洞細節會傳送給你所連接的 AI 用戶端。連接器套件中不儲存 API 金鑰。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Xfa，將其新增到工作區。
  2. 連接 所需的 憑證。它們會被私密儲存，絕不會在公開頁面上展示。
  3. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/tech.xfa%2Fxfa/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。 客戶端會在首次連接時完成 OAuth 登入。

{
  "mcpServers": {
    "xfa": {
      "type": "http",
      "url": "https://mcp.xfa.tech/mcp"
    }
  }
}

README

XFA MCP

XFA is a BYOD device-trust platform. This is XFA's remote Model Context Protocol server — query your organization's device posture, compliance, policies, and software/CVE status from Claude, ChatGPT, Cursor, and other AI assistants. Read-only.

This repository is the connector package for AI marketplaces. The MCP server itself is hosted by XFA at https://mcp.xfa.tech/mcp; nothing runs locally. Authentication is OAuth 2.0 (PKCE) — you sign in with your XFA account on connect.

Where it's published

SurfaceStatusWhere to submit / find
Official MCP Registry✅ Livetech.xfa/xfa · registry.modelcontextprotocol.io
Glama⏳ Propagating from registryglama.ai/mcp/servers
Smithery⏳ Propagating from registrysmithery.ai
PulseMCP⏳ Propagating from registrypulsemcp.com
mcp.so⏳ Propagating from registrymcp.so
Cursor Marketplace🕒 Submitted — pending approvalcursor.com/marketplace/publish
Claude Connectors Directory✅ Liveclaude.ai/directory/mcp-xfa-tech
ChatGPT app directory✅ Livechatgpt.com/plugins/…
Gemini / Antigravity CLI✅ Installable · ⏳ gallery auto-crawlgemini-cli-extension topic set; also via the MCP Registry
awesome-mcp-servers🕒 PR open — #12739Security section

Legend: ✅ live · ⏳ propagating (no action) · 🕒 pending. Update a row when its listing goes live.

Gemini note: the Gemini CLI gallery has no submission form — it crawls public repos tagged with the gemini-cli-extension GitHub topic daily (already set). Gemini CLI merged into Antigravity CLI (June 2026); Antigravity discovers MCP servers via the MCP Registry, where this server is already live, so no separate Antigravity submission is needed.

Install

Cursor

One-click:

cursor://anysphere.cursor-deeplink/mcp/install?name=xfa&config=eyJ1cmwiOiJodHRwczovL21jcC54ZmEudGVjaC9tY3AifQ==

Or add to ~/.cursor/mcp.json:

json
{  "mcpServers": {    "xfa": { "url": "https://mcp.xfa.tech/mcp" }  }}

Claude

Settings → Connectors → Add custom connector → URL https://mcp.xfa.tech/mcp.

ChatGPT

Settings → Connectors → Add → MCP server URL https://mcp.xfa.tech/mcp.

Gemini CLI

Install the extension:

gemini extensions install https://github.com/gl-ventures/xfa-mcp

The bundled gemini-extension.json points at the remote server; Gemini discovers OAuth from the server metadata and prompts you to sign in on first use.

VS Code / Windsurf / Zed / other MCP clients

Point the client at the remote URL https://mcp.xfa.tech/mcp (streamable HTTP / SSE, OAuth 2.0).

Tools

All tools are read-only. The live server is the source of truth — clients fetch the current tool list from the endpoint on every connection, so this list may lag the deployed server. See the Connect an AI assistant docs for the maintained reference.

Your organization (scoped to the signed-in user's org)

ToolDescription
get_organizationGet your XFA organization
get_current_userGet the signed-in user
list_devicesList devices (active in the last 30 days)
get_deviceGet a single device
get_compliance_summaryOrg-wide compliance summary
get_posture_trendsPosture trends over time
list_policiesList policies

Software & vulnerabilities (XFA's tracked-software catalog)

ToolDescription
get_latest_versionLatest known version of a piece of software
list_versioned_software_catalogList the software XFA tracks
get_software_version_infoStatus of a specific software version
get_cves_for_versionCVEs affecting a software version

Authentication

OAuth 2.0 with PKCE (S256), scope mcp:read. On connect you are redirected to XFA to authorize; no API keys or tokens are stored in this package. The client auto-discovers the OAuth endpoints from the server's already-published metadata:

  • https://mcp.xfa.tech/.well-known/oauth-protected-resource
  • https://mcp.xfa.tech/.well-known/oauth-authorization-server

Support

Maintainers

The MCP Registry workflow validates server.json on every change and publishes to the official MCP Registry on pushes to main (or via Run workflow). It authenticates by DNS against the v=MCPv1 TXT record on the xfa.tech apex.

To release a new version: bump version in server.json, merge to main.

Required repo secret: MCP_REGISTRY_KEY_PEM — the Ed25519 private key PEM (pairs with the DNS TXT record). Keep the matching key backed up in a password manager.

License

MIT — see LICENSE.

來源：README.md，提交 dfbb076

工具

0
該伺服器需要登入，因此 SourceWeft 無法在沒有帳號的情況下讀取其工具，也未收錄。已連接帳號所能看到的內容可能因帳號及其權限而異。

版本歷史

1
  1. v0.1.2最新Sep 16, 2026

評分

已滿足適用檢查項的 85%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分