Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

PCFHub

REMOTE · PCFHUB.DEV · SCANNED SEP 20

Find Power Apps PCF controls, read their docs, and validate pcfhub.json manifests.

Available components

+2 this week 69 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security63
Transport & Reachability100
Schema Quality & AI Usability71
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 1560 tokens (~195/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management23
  • Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 8 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
Install

How do I install the PCFHub MCP server?

PCFHub is a hosted endpoint at https://pcfhub.dev/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · pcfhub.dev

# add to Claude Code
claude mcp add --transport http pcfhub-pcfhub 'https://pcfhub.dev/mcp'
// .cursor/mcp.json
{
  "mcpServers": {
    "pcfhub-pcfhub": {
      "url": "https://pcfhub.dev/mcp"
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "pcfhub-pcfhub": {
      "type": "http",
      "url": "https://pcfhub.dev/mcp"
    }
  }
}
# ~/.codex/config.toml
[mcp_servers.pcfhub-pcfhub]
url = "https://pcfhub.dev/mcp"
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "pcfhub-pcfhub": {
      "type": "remote",
      "url": "https://pcfhub.dev/mcp",
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add pcfhub-pcfhub --url 'https://pcfhub.dev/mcp' --transport streamable-http
# ~/.hermes/config.yaml
mcp_servers:
  pcfhub-pcfhub:
    url: "https://pcfhub.dev/mcp"
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "pcfhub-pcfhub": {
      "Transport": "http",
      "Url": "https://pcfhub.dev/mcp"
    }
  }
}
# add to Vellum
assistant mcp add pcfhub-pcfhub -t streamable-http -u 'https://pcfhub.dev/mcp'
// mcp.json
{
  "mcpServers": {
    "pcfhub-pcfhub": {
      "type": "http",
      "url": "https://pcfhub.dev/mcp"
    }
  }
}

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 20 Sept 26 0
    • Tool “list_components” rewrote its description, which is the text the model reads security
    • Tool “list_taxonomy” rewrote its description, which is the text the model reads security
    • “list_components” added an optional parameter “host” cosmetic
    • Tool “list_taxonomy” changed its title: List categories, tags or authors → List categories, tags, authors or hosts cosmetic
  • 19 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

  • 18 Sept 26 0
    • MCP protocol: Implements a current MCP spec version (2026-07-28). functional
    • MCP protocol version: 2025-11-25 → 2026-07-28 functional
  • 17 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

  • 16 Sept 26 −1
    • The server rewrote its instructions, which are the text every model session reads security
    • Tool “get_component” rewrote its description, which is the text the model reads security
    • Tool “get_doc_page” rewrote its description, which is the text the model reads security
    • Tool “list_components” rewrote its description, which is the text the model reads security
    • Tool “list_doc_sections” rewrote its description, which is the text the model reads security
    • Tool “list_releases” rewrote its description, which is the text the model reads security
    • Tool “list_taxonomy” rewrote its description, which is the text the model reads security
    • Tool “search” rewrote its description, which is the text the model reads security
    • Tool “validate_manifest” rewrote its description, which is the text the model reads security
    • Schema quality: 125 → 191 functional
    • Tool “get_component” now declares an output schema functional
    • Tool “get_doc_page” now declares an output schema functional
    • Tool “list_components” now declares an output schema functional
    • Tool “list_doc_sections” now declares an output schema functional
    • Tool “list_releases” now declares an output schema functional
    • Tool “list_taxonomy” now declares an output schema functional
    • Tool “search” now declares an output schema functional
    • Tool “validate_manifest” now declares an output schema functional
    • First check of Tool coverage: 100 functional
  • 14 Sept 26 +1
    • Stability: unverified → 0.03 functional
  • 13 Sept 26 67

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Probed https://pcfhub.dev/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_256_GCM_SHA384 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=pcfhub.dev CN=YR1,O=Let's Encrypt,C=US 9 Aug 2026 7 Nov 2026 RSA 2048 SHA256-RSA 54242a38b2e3d88a8f82cb2f3505091667a
SANs: pcfhub.dev, pcfhub.dev.softwarerc.com, www.pcfhub.dev, www.pcfhub.dev.softwarerc.com
CN=YR1,O=Let's Encrypt,C=US (CA) CN=Root YR,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 RSA 2048 SHA256-RSA a20253f15f2691c05dc1ce13b9bcca4e
CN=Root YR,O=ISRG,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 RSA 4096 SHA256-RSA f24b6d17f9d9ad7cb1c9fea78782699f

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of pcfhub.dev. Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
dev. present 60074 8 Verified
pcfhub.dev. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200
Header Value
strict-transport-security max-age=31536000; includeSubDomains
x-content-type-options nosniff
x-frame-options SAMEORIGIN
referrer-policy strict-origin-when-cross-origin

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://pcfhub.dev/mcp Verified 200
http (plaintext) http://pcfhub.dev/mcp HTTPS enforced 301 https://pcfhub.dev/mcp
MCP tools · 8 exposed · ~1,312 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
get_component ~198

Everything about one control by its slug: what it does, its control type, license and repository, the current release's properties, and download links for its solutions. Use it once search or list_components has given you a slug; use get_doc_page for installation and configuration instructions, which this does not return. An unknown slug, or a version the control never released, returns an error naming the tool to call instead. include_versions and include_related each cost an extra query, so leave them off unless you need the release history or similar controls.

NameTypeReqDescription
include_relatedbooleanAlso return similar controls. Costs an extra query; leave off unless needed.
include_versionsbooleanAlso return every release. Costs an extra query; leave off unless needed.
slugstringyesThe control's slug, e.g. "pcf-tag-list".
versionstringA specific release. Defaults to the latest stable one.
NameTypeReqDescription
authorobject
categoryobject
controlTypestringyes
controlTypeDescriptionstringWhat that control type means, in a sentence.
currentVersionobject|nullThe release described, or null where nothing has been published yet.
downloadCountinteger
downloadsarrayyesEmpty where the control has no published release.
homepageUrlstring|null
hostsarrayyesWhere this control runs: canvas apps, model-driven apps, or both.
isArchivedbooleanyesTrue when the control is no longer maintained.
licenseSpdxstring|nullSPDX identifier, e.g. "MIT".
namestringyes
publishedAtstring|nullISO 8601.
relatedarrayEmpty unless include_related was set.
repositoryUrlstring|null
slugstringyes
summaryMdstring|nullThe author's longer description, as Markdown.
supportUrlstring|nullWhere to report a problem with the control.
taglinestring|null
tagsarray
tierstringfree, or a paid tier.
urlstringyesAbsolute URL of the control's page, for citing.
versionsarrayEmpty unless include_versions was set.

No examples provided.

get_doc_page ~149

Read one documentation section of a control as Markdown — installation steps, canvas or model-driven configuration, examples, limitations. Use list_doc_sections first for the sections that control publishes; use get_component instead for the structured property reference. Passing a version returns the documentation pinned to that release rather than the current page. A section the control does not document returns an error pointing at list_doc_sections, and the Markdown comes back without the frontmatter the site keeps.

NameTypeReqDescription
sectionstringyesWhich section to read.
slugstringyesThe control's slug, e.g. "pcf-tag-list".
versionstringDocumentation pinned to a specific release. Defaults to the current documentation.
NameTypeReqDescription
componentNamestringyes
componentSlugstringyes
contentMdstringyesThe page as Markdown, with its frontmatter removed. Empty when the page has no content.
descriptionstring|null
isVersionPinnedbooleanyesTrue when a version was asked for, rather than the current documentation being returned.
sectionstringyes
sourceUrlstring|nullThe file in the author's repository this was compiled from.
titlestringyes
updatedAtstring|nullISO 8601.
urlstringyesAbsolute URL of the page, for citing.
versionstring|nullThe release this documentation describes.

No examples provided.

list_components ~296

Browse the PCFHub catalog by category, tag, author, control type, host or text, paged and sorted. Use it to enumerate or narrow the catalog; use search for a plain-language question about what a control should do, and get_component for one control in full. Filters take slugs, which list_taxonomy supplies. Nothing here fails on bad input: an unrecognised sort falls back to the default, and filters matching nothing return an empty page — so read `total` and `sort` from the result rather than assuming the filters applied.

NameTypeReqDescription
authorstringAn author slug, from list_taxonomy.
categorystringA category slug, from list_taxonomy.
control_typestringfield binds one column on a form; dataset renders a view; virtual is a React control; grid_customizer changes how an editable grid renders cells.
hoststringWhere the control has to run. A control supporting both hosts matches either.
pageintegerDefaults to 1.
per_pageintegerDefaults to 24; at most 48.
querystringWords to match against names, taglines and descriptions.
sortstringDefaults to relevance when there is a query, newest otherwise.
tagsarrayTag slugs, from list_taxonomy. A control must carry every tag given.
NameTypeReqDescription
componentsarrayyes
lastPageintegeryesThe highest page number for these filters.
pageintegeryesThe page returned.
perPageintegeryes
sortstringyesThe sort actually applied, which is the default when none was given or the one given was not recognised.
totalintegeryesControls matching the filters, across every page.

No examples provided.

list_doc_sections ~121

The documentation sections one control publishes — overview, installation, canvas, model_driven, examples, limitations and so on — each with its title and URL. Use it before get_doc_page to learn which sections that control actually has; it returns no page content, and get_component covers the property reference. A control with no documentation and a slug that does not exist return the same error on purpose, so fall back to search rather than concluding the slug is wrong.

NameTypeReqDescription
slugstringyesThe control's slug, e.g. "pcf-tag-list".
NameTypeReqDescription
sectionsarrayyes
slugstringyesThe control the sections belong to.

No examples provided.

list_releases ~111

The most recent releases across every control on PCFHub, newest first: which control, which version, whether it is a prerelease, and when it shipped. Use it for what has changed hub-wide; for one control's own history call get_component with include_versions instead. Bounded by limit, at most 50, and not paged — there is no cursor, so it cannot walk back beyond the newest 50.

NameTypeReqDescription
limitintegerHow many releases. Defaults to 20.
NameTypeReqDescription
releasesarrayyesNewest first.

No examples provided.

list_taxonomy ~118

The vocabulary list_components filters by: the category tree, the tags in use, the authors with a published control, or the hosts a control can run in, each with its slug and a count. Use it to turn a name a person used into a slug; it returns no controls, so pass the slug to list_components to see them. Not paged — categories come back as a full tree and authors as a full list, while tags are capped at the 500 most used.

NameTypeReqDescription
kindstringyesWhich list to return.
NameTypeReqDescription
itemsarrayyes
kindstringyesWhich list this is.

No examples provided.

search ~159

Full-text search across every published PCF control and its documentation, ranked by relevance. Use it when you know what a control should do but not what it is called; use list_components instead to filter by category, tag, author or control type, and get_component when you already have a slug. Returns control and documentation hits, each with a snippet and a URL. A query that matches nothing is an empty result rather than an error, and a misspelling may be answered with results for a corrected spelling, which the result states.

NameTypeReqDescription
limitintegerHow many results to return. Defaults to 10.
querystringyesWhat to look for, in plain words: "barcode scanner", "kanban", "date range".
NameTypeReqDescription
correctedQuerystring|nullSet only when nothing matched the query and these are results for a corrected spelling of it.
hitsarrayyes
querystringyesThe query as it was searched.
totalintegeryesHow many results matched, which may be more than were returned.

No examples provided.

validate_manifest ~160

Check a pcfhub.json against the rules PCFHub applies when it publishes a control: the schema version, the control block (namespace, constructor, type and framework), the demo's fidelity, bundle and presets, the media files it declares, and the release artifacts it expects to find. Use it while writing or reviewing that file, before a release is tagged. An invalid manifest is an ordinary result — valid false, with errors that block publishing and warnings that do not, each carrying the JSON pointer it applies to — so read the result rather than retrying. Only an empty, unreadable or oversized manifest (over 64 KB) is an error.

NameTypeReqDescription
manifeststringyesThe full contents of pcfhub.json, as JSON text.
NameTypeReqDescription
errorsarrayyesMust be fixed; publishing refuses the manifest until they are.
schemaVersionstringyesThe manifest schema version it was checked against.
validbooleanyesFalse when there is at least one error. Warnings alone leave it true.
warningsarrayyesDo not block publishing, but reach the author through their own CI.

No examples provided.

Common questions

What is the PCFHub MCP server?

PCFHub is an MCP server listed in the public MCP registry as io.github.pcfhub/pcfhub. Find Power Apps PCF controls, read their docs, and validate pcfhub.json manifests. This page covers its hosted endpoint (https://pcfhub.dev/mcp).

Is the PCFHub MCP server safe to use?

PCFHub scores 69 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the PCFHub MCP server expose?

PCFHub exposes 8 tools: search, list_components, get_component, list_doc_sections, get_doc_page, and 3 more. Their descriptions and schemas cost roughly 1,312 tokens of context every time the server is loaded.

Does the PCFHub MCP server require authentication?

No. We connected to PCFHub without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the PCFHub MCP server still maintained?

PCFHub is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.