Endorsement Index: HUD multifamily loans
REMOTE · HUDMULTIFAMILY.LOAN
FHA-insured apartment loans from HUD's active file, plus HUD multifamily program rules and limits.
Available components
Last scanned (6 hours ago)
Scores higher than 53% of remote servers
Reachable. Last reached 5 Nov 2026.
Category Finance and Payments
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security74
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability56
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 1290 tokens (~215/item across 6 items; 6 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management10
- Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage83
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 49% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 6 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 7 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Nov 26 +1
- Stability: unverified → 0.03 ▲ functional
- 2 Nov 26 66
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://hudmultifamily.loan/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=hudmultifamily.loan | CN=WE1,O=Google Trust Services,C=US | 24 Oct 2026 | 22 Jan 2027 | ECDSA 256 | ECDSA-SHA256 | 596ce5e12abba5ee0e18d1c04523ce38 |
| SANs: hudmultifamily.loan | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of hudmultifamily.loan. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| loan. | present | 61084 | 8 | Verified |
| hudmultifamily.loan. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://hudmultifamily.loan/mcp | Verified | 200 | |
| http (plaintext) | http://hudmultifamily.loan/mcp | HTTPS enforced | 301 | https://hudmultifamily.loan/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
get_loan Get one FHA-insured apartment loan ~116
Look up one loan by its 8-digit HUD project (FHA) number: every field HUD publishes for it, plus years left, the property page URL, HUD physical inspection scores (latest and up to two prior, with release dates and REAC/NSPIRE scoring) and active Section 8 / rental assistance contracts (assisted units, expiration, latest renewal option), each with HUD as-of date and source.
| Name | Type | Req | Description |
|---|---|---|---|
| fha_number | string | yes | 8-digit HUD project number, e.g. 17635050. |
No output schema declared.
No examples provided.
hud_stats HUD apartment loan portfolio statistics ~78
Totals and medians for FHA-insured apartment loans in HUD's active file: loan count, units, balances, median note rate, the 12-month realized-rate benchmark, and breakdowns by program and state. Pass state or program to narrow it.
| Name | Type | Req | Description |
|---|---|---|---|
| program | string | – | – |
| state | string | – | Two-letter state code. |
No output schema declared.
No examples provided.
program_facts HUD multifamily program rules ~119
Current rules for a HUD multifamily program (223f, 221d4, 223a7, 241a, 220, 231, 213): max LTV/LTC and DSCR tiers (ML 2025-03), term, MIP (0.25%/0.25%), prepayment, Davis-Bacon, fees, commercial limits, plus live counts from HUD's file. Each rule has a primary source URL. Omit program for the summary of all.
| Name | Type | Req | Description |
|---|---|---|---|
| program | string | – | – |
No output schema declared.
No examples provided.
search_loans Search FHA-insured apartment loans ~296
Search every FHA-insured apartment loan in HUD's active multifamily file by state, city, program, note rate, years left, servicer or text. Returns HUD's figures (note rate, original amount, amortized balance, maturity, holder, servicer, Section of the Act) with a property page URL. Use it to find assumable low-rate loans, loans by a servicer, or a property's FHA number.
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | – | City, exact match (case-insensitive). |
| lihtc | boolean | – | – |
| limit | integer | – | – |
| max_balance | number | – | – |
| max_rate | number | – | Maximum note rate, percent (e.g. 4 for assumable low-rate loans). |
| max_years_left | number | – | – |
| min_balance | number | – | Minimum amortized balance, US dollars. |
| min_rate | number | – | Minimum note rate, percent. |
| min_units | integer | – | – |
| min_years_left | number | – | Minimum years to maturity. |
| offset | integer | – | – |
| program | string | – | – |
| q | string | – | Words to match in property name, city, address, ZIP or FHA number. |
| servicer | string | – | Servicer name fragment, e.g. Greystone. |
| sort | string | – | – |
| state | string | – | Two-letter state code, e.g. TX. |
No output schema declared.
No examples provided.
size_223f Size a HUD 223(f) loan (lowest of LTV, DSCR, statutory limit) ~310
Estimate maximum 223(f) proceeds as the lowest of: LTV (87% market, 90% affordable or 90%+ assisted), DSCR (1.15x market, 1.11x affordable) with debt service including the 0.25% annual MIP, the CY2026 statutory limit for the unit mix, and the cost-to-refinance or cash-out cap. Returns each test, the binding one, payment and MIP. If note_rate is omitted it uses the median note rate on 223(f) loans HUD endorsed in the last 12 months (realized history, not a quote). An estimate, not a commitment.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | – |
| cost_to_refinance | number | – | Existing debt plus transaction costs and repairs, US dollars. |
| elevator | boolean | – | – |
| high_cost_pct | number | – | – |
| noi | number | yes | Annual underwritten net operating income, US dollars. |
| note_rate | number | – | Note rate, percent, excluding MIP. |
| purpose | string | – | – |
| requested | number | – | Requested loan amount, US dollars. |
| term_years | number | – | – |
| unit_mix | object | – | Units by bedroom count, e.g. {"0": 10, "1": 40, "2": 30, "3": 0, "4+": 0}. |
| value | number | yes | Appraised value, US dollars. |
No output schema declared.
No examples provided.
statutory_limit HUD statutory per-unit limit for a unit mix ~158
Compute the CY2026 statutory mortgage limit for a unit mix: table amount per bedroom count (elevator or not) times the high cost percentage (270% standard for 2026, up to 315% project by project in High Cost Areas, 405% in Alaska, Hawaii, Guam and USVI). Also reports the ROAD to Housing Act base amounts, which are enacted but pending HUD implementation.
| Name | Type | Req | Description |
|---|---|---|---|
| elevator | boolean | – | – |
| high_cost_pct | number | – | – |
| program | string | – | – |
| unit_mix | object | yes | Units by bedroom count, e.g. {"0": 10, "1": 40, "2": 30, "3": 0, "4+": 0}. |
No output schema declared.
No examples provided.
How do I install the Endorsement Index: HUD multifamily loans MCP server?
Endorsement Index: HUD multifamily loans is a hosted endpoint at https://hudmultifamily.loan/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · hudmultifamily.loan
claude mcp add --transport http loan-hudmultifamily-hudmultifamily-loan 'https://hudmultifamily.loan/mcp'
What is the Endorsement Index: HUD multifamily loans MCP server?
Endorsement Index: HUD multifamily loans is an MCP server listed in the public MCP registry as loan.hudmultifamily/hudmultifamily-loan. FHA-insured apartment loans from HUD's active file, plus HUD multifamily program rules and limits. This page covers its hosted endpoint (https://hudmultifamily.loan/mcp).
Is the Endorsement Index: HUD multifamily loans MCP server safe to use?
Endorsement Index: HUD multifamily loans scores 68 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Endorsement Index: HUD multifamily loans MCP server expose?
Endorsement Index: HUD multifamily loans exposes 6 tools: search_loans, get_loan, program_facts, statutory_limit, size_223f, hud_stats. Their descriptions and schemas cost roughly 1,077 tokens of context every time the server is loaded.
Does the Endorsement Index: HUD multifamily loans MCP server require authentication?
No. We connected to Endorsement Index: HUD multifamily loans without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Endorsement Index: HUD multifamily loans MCP server still maintained?
Endorsement Index: HUD multifamily loans is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.