Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

PCFHub

REMOTE · PCFHUB.DEV

Find Power Apps PCF controls, read their docs, and validate pcfhub.json manifests.

Available components

0 this week 87 Trust /100

Last scanned (7 hours ago)

Scores higher than 94% of remote servers

Reachable. Last reached 5 Nov 2026.

Category Code Search and Documentation

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security80
Transport & Reachability100
Schema Quality & AI Usability70
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 1625 tokens (~203/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 8 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 13 Oct 26 +1
    • Stability: 0.97 → pass security
  • 12 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 97. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 10 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 80 to 90. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

  • 7 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 70 to 80. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes. Other categories moved too: Schema Quality & AI Usability fell 1.

  • 4 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 67 to 70. That category is still filling its 30-day observation window: 20 days of observed history at the previous scan, 21 at this one. The score rises as the window fills, whether or not the server changes.

  • 28 Sept 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 25 Sept 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 20 Sept 26 0
    • Tool “list_components” rewrote its description, which is the text the model reads security
    • Tool “list_taxonomy” rewrote its description, which is the text the model reads security
    • “list_components” added an optional parameter “host” cosmetic
    • Tool “list_taxonomy” changed its title: List categories, tags or authors → List categories, tags, authors or hosts cosmetic
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Probed https://pcfhub.dev/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_256_GCM_SHA384 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=pcfhub.dev CN=YR1,O=Let's Encrypt,C=US 9 Aug 2026 7 Nov 2026 RSA 2048 SHA256-RSA 54242a38b2e3d88a8f82cb2f3505091667a
SANs: pcfhub.dev, pcfhub.dev.softwarerc.com, www.pcfhub.dev, www.pcfhub.dev.softwarerc.com
CN=YR1,O=Let's Encrypt,C=US (CA) CN=Root YR,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 RSA 2048 SHA256-RSA a20253f15f2691c05dc1ce13b9bcca4e
CN=Root YR,O=ISRG,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 RSA 4096 SHA256-RSA f24b6d17f9d9ad7cb1c9fea78782699f

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of pcfhub.dev. — Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
dev. present 60074 8 Verified
pcfhub.dev. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200
Header Value
strict-transport-security max-age=31536000; includeSubDomains
x-content-type-options nosniff
x-frame-options SAMEORIGIN
referrer-policy strict-origin-when-cross-origin

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://pcfhub.dev/mcp Verified 200
http (plaintext) http://pcfhub.dev/mcp HTTPS enforced 301 https://pcfhub.dev/mcp
MCP tools · 8 exposed · ~1,312 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
get_component ~198

Everything about one control by its slug: what it does, its control type, license and repository, the current release's properties, and download links for its solutions. Use it once search or list_components has given you a slug; use get_doc_page for installation and configuration instructions, which this does not return. An unknown slug, or a version the control never released, returns an error naming the tool to call instead. include_versions and include_related each cost an extra query, so leave them off unless you need the release history or similar controls.

NameTypeReqDescription
include_relatedboolean–Also return similar controls. Costs an extra query; leave off unless needed.
include_versionsboolean–Also return every release. Costs an extra query; leave off unless needed.
slugstringyesThe control's slug, e.g. "pcf-tag-list".
versionstring–A specific release. Defaults to the latest stable one.
NameTypeReqDescription
authorobject––
builtWithstring|null–ai where an AI assistant wrote the code, ai-assisted where a person wrote it with one. Null where the author has not said.
categoryobject––
controlTypestringyes–
controlTypeDescriptionstring–What that control type means, in a sentence.
currentVersionobject|null–The release described, or null where nothing has been published yet.
downloadCountinteger––
downloadsarrayyesEmpty where the control has no published release.
homepageUrlstring|null––
hostsarrayyesWhere this control runs: canvas apps, model-driven apps, or both.
isArchivedbooleanyesTrue when the control is no longer maintained.
licenseSpdxstring|null–SPDX identifier, e.g. "MIT".
namestringyes–
publishedAtstring|null–ISO 8601.
relatedarray–Empty unless include_related was set.
repositoryUrlstring|null––
slugstringyes–
summaryMdstring|null–The author's longer description, as Markdown.
supportLevelstring|null–maintained, or reference: a worked example not maintained for production. Null where the author has not said.
supportUrlstring|null–Where to report a problem with the control.
taglinestring|null––
tagsarray––
tierstring–free, or a paid tier.
urlstringyesAbsolute URL of the control's page, for citing.
versionsarray–Empty unless include_versions was set.

No examples provided.

get_doc_page ~149

Read one documentation section of a control as Markdown — installation steps, canvas or model-driven configuration, examples, limitations. Use list_doc_sections first for the sections that control publishes; use get_component instead for the structured property reference. Passing a version returns the documentation pinned to that release rather than the current page. A section the control does not document returns an error pointing at list_doc_sections, and the Markdown comes back without the frontmatter the site keeps.

NameTypeReqDescription
sectionstringyesWhich section to read.
slugstringyesThe control's slug, e.g. "pcf-tag-list".
versionstring–Documentation pinned to a specific release. Defaults to the current documentation.
NameTypeReqDescription
componentNamestringyes–
componentSlugstringyes–
contentMdstringyesThe page as Markdown, with its frontmatter removed. Empty when the page has no content.
descriptionstring|null––
isVersionPinnedbooleanyesTrue when a version was asked for, rather than the current documentation being returned.
sectionstringyes–
sourceUrlstring|null–The file in the author's repository this was compiled from.
titlestringyes–
updatedAtstring|null–ISO 8601.
urlstringyesAbsolute URL of the page, for citing.
versionstring|null–The release this documentation describes.

No examples provided.

list_components ~296

Browse the PCFHub catalog by category, tag, author, control type, host or text, paged and sorted. Use it to enumerate or narrow the catalog; use search for a plain-language question about what a control should do, and get_component for one control in full. Filters take slugs, which list_taxonomy supplies. Nothing here fails on bad input: an unrecognised sort falls back to the default, and filters matching nothing return an empty page — so read `total` and `sort` from the result rather than assuming the filters applied.

NameTypeReqDescription
authorstring–An author slug, from list_taxonomy.
categorystring–A category slug, from list_taxonomy.
control_typestring–field binds one column on a form; dataset renders a view; virtual is a React control; grid_customizer changes how an editable grid renders cells.
hoststring–Where the control has to run. A control supporting both hosts matches either.
pageinteger–Defaults to 1.
per_pageinteger–Defaults to 24; at most 48.
querystring–Words to match against names, taglines and descriptions.
sortstring–Defaults to relevance when there is a query, newest otherwise.
tagsarray–Tag slugs, from list_taxonomy. A control must carry every tag given.
NameTypeReqDescription
componentsarrayyes–
lastPageintegeryesThe highest page number for these filters.
pageintegeryesThe page returned.
perPageintegeryes–
sortstringyesThe sort actually applied, which is the default when none was given or the one given was not recognised.
totalintegeryesControls matching the filters, across every page.

No examples provided.

list_doc_sections ~121

The documentation sections one control publishes — overview, installation, canvas, model_driven, examples, limitations and so on — each with its title and URL. Use it before get_doc_page to learn which sections that control actually has; it returns no page content, and get_component covers the property reference. A control with no documentation and a slug that does not exist return the same error on purpose, so fall back to search rather than concluding the slug is wrong.

NameTypeReqDescription
slugstringyesThe control's slug, e.g. "pcf-tag-list".
NameTypeReqDescription
sectionsarrayyes–
slugstringyesThe control the sections belong to.

No examples provided.

list_releases ~111

The most recent releases across every control on PCFHub, newest first: which control, which version, whether it is a prerelease, and when it shipped. Use it for what has changed hub-wide; for one control's own history call get_component with include_versions instead. Bounded by limit, at most 50, and not paged — there is no cursor, so it cannot walk back beyond the newest 50.

NameTypeReqDescription
limitinteger–How many releases. Defaults to 20.
NameTypeReqDescription
releasesarrayyesNewest first.

No examples provided.

list_taxonomy ~118

The vocabulary list_components filters by: the category tree, the tags in use, the authors with a published control, or the hosts a control can run in, each with its slug and a count. Use it to turn a name a person used into a slug; it returns no controls, so pass the slug to list_components to see them. Not paged — categories come back as a full tree and authors as a full list, while tags are capped at the 500 most used.

NameTypeReqDescription
kindstringyesWhich list to return.
NameTypeReqDescription
itemsarrayyes–
kindstringyesWhich list this is.

No examples provided.

search ~159

Full-text search across every published PCF control and its documentation, ranked by relevance. Use it when you know what a control should do but not what it is called; use list_components instead to filter by category, tag, author or control type, and get_component when you already have a slug. Returns control and documentation hits, each with a snippet and a URL. A query that matches nothing is an empty result rather than an error, and a misspelling may be answered with results for a corrected spelling, which the result states.

NameTypeReqDescription
limitinteger–How many results to return. Defaults to 10.
querystringyesWhat to look for, in plain words: "barcode scanner", "kanban", "date range".
NameTypeReqDescription
correctedQuerystring|null–Set only when nothing matched the query and these are results for a corrected spelling of it.
hitsarrayyes–
querystringyesThe query as it was searched.
totalintegeryesHow many results matched, which may be more than were returned.

No examples provided.

validate_manifest ~160

Check a pcfhub.json against the rules PCFHub applies when it publishes a control: the schema version, the control block (namespace, constructor, type and framework), the demo's fidelity, bundle and presets, the media files it declares, and the release artifacts it expects to find. Use it while writing or reviewing that file, before a release is tagged. An invalid manifest is an ordinary result — valid false, with errors that block publishing and warnings that do not, each carrying the JSON pointer it applies to — so read the result rather than retrying. Only an empty, unreadable or oversized manifest (over 64 KB) is an error.

NameTypeReqDescription
manifeststringyesThe full contents of pcfhub.json, as JSON text.
NameTypeReqDescription
errorsarrayyesMust be fixed; publishing refuses the manifest until they are.
schemaVersionintegeryesThe manifest schema version it was checked against.
validbooleanyesFalse when there is at least one error. Warnings alone leave it true.
warningsarrayyesDo not block publishing, but reach the author through their own CI.

No examples provided.

Install

How do I install the PCFHub MCP server?

PCFHub is a hosted endpoint at https://pcfhub.dev/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · pcfhub.dev

# add to Claude Code
claude mcp add --transport http pcfhub-pcfhub 'https://pcfhub.dev/mcp'
Common questions

What is the PCFHub MCP server?

PCFHub is an MCP server listed in the public MCP registry as io.github.pcfhub/pcfhub. Find Power Apps PCF controls, read their docs, and validate pcfhub.json manifests. This page covers its hosted endpoint (https://pcfhub.dev/mcp).

Is the PCFHub MCP server safe to use?

PCFHub scores 87 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the PCFHub MCP server expose?

PCFHub exposes 8 tools: search, list_components, get_component, list_doc_sections, get_doc_page, and 3 more. Their descriptions and schemas cost roughly 1,312 tokens of context every time the server is loaded.

Does the PCFHub MCP server require authentication?

No. We connected to PCFHub without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the PCFHub MCP server still maintained?

PCFHub is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.