PCFHub
REMOTE · PCFHUB.DEV · SCANNED SEP 20
Find Power Apps PCF controls, read their docs, and validate pcfhub.json manifests.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 8 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability71
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1560 tokens (~195/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management23
- Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 8 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the PCFHub MCP server?
PCFHub is a hosted endpoint at https://pcfhub.dev/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · pcfhub.dev
claude mcp add --transport http pcfhub-pcfhub 'https://pcfhub.dev/mcp'
{
"mcpServers": {
"pcfhub-pcfhub": {
"url": "https://pcfhub.dev/mcp"
}
}
} {
"servers": {
"pcfhub-pcfhub": {
"type": "http",
"url": "https://pcfhub.dev/mcp"
}
}
} [mcp_servers.pcfhub-pcfhub] url = "https://pcfhub.dev/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"pcfhub-pcfhub": {
"type": "remote",
"url": "https://pcfhub.dev/mcp",
"enabled": true
}
}
} openclaw mcp add pcfhub-pcfhub --url 'https://pcfhub.dev/mcp' --transport streamable-http
mcp_servers:
pcfhub-pcfhub:
url: "https://pcfhub.dev/mcp" {
"McpServers": {
"pcfhub-pcfhub": {
"Transport": "http",
"Url": "https://pcfhub.dev/mcp"
}
}
} assistant mcp add pcfhub-pcfhub -t streamable-http -u 'https://pcfhub.dev/mcp'
{
"mcpServers": {
"pcfhub-pcfhub": {
"type": "http",
"url": "https://pcfhub.dev/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 0
- Tool “list_components” rewrote its description, which is the text the model reads security
- Tool “list_taxonomy” rewrote its description, which is the text the model reads security
- “list_components” added an optional parameter “host” cosmetic
- Tool “list_taxonomy” changed its title: List categories, tags or authors → List categories, tags, authors or hosts cosmetic
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 0
- MCP protocol: Implements a current MCP spec version (2026-07-28). functional
- MCP protocol version: 2025-11-25 → 2026-07-28 functional
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 −1
- The server rewrote its instructions, which are the text every model session reads security
- Tool “get_component” rewrote its description, which is the text the model reads security
- Tool “get_doc_page” rewrote its description, which is the text the model reads security
- Tool “list_components” rewrote its description, which is the text the model reads security
- Tool “list_doc_sections” rewrote its description, which is the text the model reads security
- Tool “list_releases” rewrote its description, which is the text the model reads security
- Tool “list_taxonomy” rewrote its description, which is the text the model reads security
- Tool “search” rewrote its description, which is the text the model reads security
- Tool “validate_manifest” rewrote its description, which is the text the model reads security
- Schema quality: 125 → 191 ▼ functional
- Tool “get_component” now declares an output schema ▲ functional
- Tool “get_doc_page” now declares an output schema ▲ functional
- Tool “list_components” now declares an output schema ▲ functional
- Tool “list_doc_sections” now declares an output schema ▲ functional
- Tool “list_releases” now declares an output schema ▲ functional
- Tool “list_taxonomy” now declares an output schema ▲ functional
- Tool “search” now declares an output schema ▲ functional
- Tool “validate_manifest” now declares an output schema ▲ functional
- First check of Tool coverage: 100 functional
- 14 Sept 26 +1
- Stability: unverified → 0.03 ▲ functional
- 13 Sept 26 67
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Probed https://pcfhub.dev/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_256_GCM_SHA384 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=pcfhub.dev | CN=YR1,O=Let's Encrypt,C=US | 9 Aug 2026 | 7 Nov 2026 | RSA 2048 | SHA256-RSA | 54242a38b2e3d88a8f82cb2f3505091667a |
| SANs: pcfhub.dev, pcfhub.dev.softwarerc.com, www.pcfhub.dev, www.pcfhub.dev.softwarerc.com | ||||||
| CN=YR1,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | a20253f15f2691c05dc1ce13b9bcca4e |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of pcfhub.dev. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| dev. | present | 60074 | 8 | Verified |
| pcfhub.dev. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains |
| x-content-type-options | nosniff |
| x-frame-options | SAMEORIGIN |
| referrer-policy | strict-origin-when-cross-origin |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://pcfhub.dev/mcp | Verified | 200 | |
| http (plaintext) | http://pcfhub.dev/mcp | HTTPS enforced | 301 | https://pcfhub.dev/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
get_component Get a PCF control ~198
Everything about one control by its slug: what it does, its control type, license and repository, the current release's properties, and download links for its solutions. Use it once search or list_components has given you a slug; use get_doc_page for installation and configuration instructions, which this does not return. An unknown slug, or a version the control never released, returns an error naming the tool to call instead. include_versions and include_related each cost an extra query, so leave them off unless you need the release history or similar controls.
| Name | Type | Req | Description |
|---|---|---|---|
| include_related | boolean | – | Also return similar controls. Costs an extra query; leave off unless needed. |
| include_versions | boolean | – | Also return every release. Costs an extra query; leave off unless needed. |
| slug | string | yes | The control's slug, e.g. "pcf-tag-list". |
| version | string | – | A specific release. Defaults to the latest stable one. |
| Name | Type | Req | Description |
|---|---|---|---|
| author | object | – | – |
| category | object | – | – |
| controlType | string | yes | – |
| controlTypeDescription | string | – | What that control type means, in a sentence. |
| currentVersion | object|null | – | The release described, or null where nothing has been published yet. |
| downloadCount | integer | – | – |
| downloads | array | yes | Empty where the control has no published release. |
| homepageUrl | string|null | – | – |
| hosts | array | yes | Where this control runs: canvas apps, model-driven apps, or both. |
| isArchived | boolean | yes | True when the control is no longer maintained. |
| licenseSpdx | string|null | – | SPDX identifier, e.g. "MIT". |
| name | string | yes | – |
| publishedAt | string|null | – | ISO 8601. |
| related | array | – | Empty unless include_related was set. |
| repositoryUrl | string|null | – | – |
| slug | string | yes | – |
| summaryMd | string|null | – | The author's longer description, as Markdown. |
| supportUrl | string|null | – | Where to report a problem with the control. |
| tagline | string|null | – | – |
| tags | array | – | – |
| tier | string | – | free, or a paid tier. |
| url | string | yes | Absolute URL of the control's page, for citing. |
| versions | array | – | Empty unless include_versions was set. |
No examples provided.
get_doc_page Read a documentation page ~149
Read one documentation section of a control as Markdown — installation steps, canvas or model-driven configuration, examples, limitations. Use list_doc_sections first for the sections that control publishes; use get_component instead for the structured property reference. Passing a version returns the documentation pinned to that release rather than the current page. A section the control does not document returns an error pointing at list_doc_sections, and the Markdown comes back without the frontmatter the site keeps.
| Name | Type | Req | Description |
|---|---|---|---|
| section | string | yes | Which section to read. |
| slug | string | yes | The control's slug, e.g. "pcf-tag-list". |
| version | string | – | Documentation pinned to a specific release. Defaults to the current documentation. |
| Name | Type | Req | Description |
|---|---|---|---|
| componentName | string | yes | – |
| componentSlug | string | yes | – |
| contentMd | string | yes | The page as Markdown, with its frontmatter removed. Empty when the page has no content. |
| description | string|null | – | – |
| isVersionPinned | boolean | yes | True when a version was asked for, rather than the current documentation being returned. |
| section | string | yes | – |
| sourceUrl | string|null | – | The file in the author's repository this was compiled from. |
| title | string | yes | – |
| updatedAt | string|null | – | ISO 8601. |
| url | string | yes | Absolute URL of the page, for citing. |
| version | string|null | – | The release this documentation describes. |
No examples provided.
list_components List PCF controls ~296
Browse the PCFHub catalog by category, tag, author, control type, host or text, paged and sorted. Use it to enumerate or narrow the catalog; use search for a plain-language question about what a control should do, and get_component for one control in full. Filters take slugs, which list_taxonomy supplies. Nothing here fails on bad input: an unrecognised sort falls back to the default, and filters matching nothing return an empty page — so read `total` and `sort` from the result rather than assuming the filters applied.
| Name | Type | Req | Description |
|---|---|---|---|
| author | string | – | An author slug, from list_taxonomy. |
| category | string | – | A category slug, from list_taxonomy. |
| control_type | string | – | field binds one column on a form; dataset renders a view; virtual is a React control; grid_customizer changes how an editable grid renders cells. |
| host | string | – | Where the control has to run. A control supporting both hosts matches either. |
| page | integer | – | Defaults to 1. |
| per_page | integer | – | Defaults to 24; at most 48. |
| query | string | – | Words to match against names, taglines and descriptions. |
| sort | string | – | Defaults to relevance when there is a query, newest otherwise. |
| tags | array | – | Tag slugs, from list_taxonomy. A control must carry every tag given. |
| Name | Type | Req | Description |
|---|---|---|---|
| components | array | yes | – |
| lastPage | integer | yes | The highest page number for these filters. |
| page | integer | yes | The page returned. |
| perPage | integer | yes | – |
| sort | string | yes | The sort actually applied, which is the default when none was given or the one given was not recognised. |
| total | integer | yes | Controls matching the filters, across every page. |
No examples provided.
list_doc_sections List a control's documentation ~121
The documentation sections one control publishes — overview, installation, canvas, model_driven, examples, limitations and so on — each with its title and URL. Use it before get_doc_page to learn which sections that control actually has; it returns no page content, and get_component covers the property reference. A control with no documentation and a slug that does not exist return the same error on purpose, so fall back to search rather than concluding the slug is wrong.
| Name | Type | Req | Description |
|---|---|---|---|
| slug | string | yes | The control's slug, e.g. "pcf-tag-list". |
| Name | Type | Req | Description |
|---|---|---|---|
| sections | array | yes | – |
| slug | string | yes | The control the sections belong to. |
No examples provided.
list_releases List recent releases ~111
The most recent releases across every control on PCFHub, newest first: which control, which version, whether it is a prerelease, and when it shipped. Use it for what has changed hub-wide; for one control's own history call get_component with include_versions instead. Bounded by limit, at most 50, and not paged — there is no cursor, so it cannot walk back beyond the newest 50.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | How many releases. Defaults to 20. |
| Name | Type | Req | Description |
|---|---|---|---|
| releases | array | yes | Newest first. |
No examples provided.
list_taxonomy List categories, tags, authors or hosts ~118
The vocabulary list_components filters by: the category tree, the tags in use, the authors with a published control, or the hosts a control can run in, each with its slug and a count. Use it to turn a name a person used into a slug; it returns no controls, so pass the slug to list_components to see them. Not paged — categories come back as a full tree and authors as a full list, while tags are capped at the 500 most used.
| Name | Type | Req | Description |
|---|---|---|---|
| kind | string | yes | Which list to return. |
| Name | Type | Req | Description |
|---|---|---|---|
| items | array | yes | – |
| kind | string | yes | Which list this is. |
No examples provided.
search Search PCFHub ~159
Full-text search across every published PCF control and its documentation, ranked by relevance. Use it when you know what a control should do but not what it is called; use list_components instead to filter by category, tag, author or control type, and get_component when you already have a slug. Returns control and documentation hits, each with a snippet and a URL. A query that matches nothing is an empty result rather than an error, and a misspelling may be answered with results for a corrected spelling, which the result states.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | How many results to return. Defaults to 10. |
| query | string | yes | What to look for, in plain words: "barcode scanner", "kanban", "date range". |
| Name | Type | Req | Description |
|---|---|---|---|
| correctedQuery | string|null | – | Set only when nothing matched the query and these are results for a corrected spelling of it. |
| hits | array | yes | – |
| query | string | yes | The query as it was searched. |
| total | integer | yes | How many results matched, which may be more than were returned. |
No examples provided.
validate_manifest Validate a pcfhub.json ~160
Check a pcfhub.json against the rules PCFHub applies when it publishes a control: the schema version, the control block (namespace, constructor, type and framework), the demo's fidelity, bundle and presets, the media files it declares, and the release artifacts it expects to find. Use it while writing or reviewing that file, before a release is tagged. An invalid manifest is an ordinary result — valid false, with errors that block publishing and warnings that do not, each carrying the JSON pointer it applies to — so read the result rather than retrying. Only an empty, unreadable or oversized manifest (over 64 KB) is an error.
| Name | Type | Req | Description |
|---|---|---|---|
| manifest | string | yes | The full contents of pcfhub.json, as JSON text. |
| Name | Type | Req | Description |
|---|---|---|---|
| errors | array | yes | Must be fixed; publishing refuses the manifest until they are. |
| schemaVersion | string | yes | The manifest schema version it was checked against. |
| valid | boolean | yes | False when there is at least one error. Warnings alone leave it true. |
| warnings | array | yes | Do not block publishing, but reach the author through their own CI. |
No examples provided.
What is the PCFHub MCP server?
PCFHub is an MCP server listed in the public MCP registry as io.github.pcfhub/pcfhub. Find Power Apps PCF controls, read their docs, and validate pcfhub.json manifests. This page covers its hosted endpoint (https://pcfhub.dev/mcp).
Is the PCFHub MCP server safe to use?
PCFHub scores 69 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the PCFHub MCP server expose?
PCFHub exposes 8 tools: search, list_components, get_component, list_doc_sections, get_doc_page, and 3 more. Their descriptions and schemas cost roughly 1,312 tokens of context every time the server is loaded.
Does the PCFHub MCP server require authentication?
No. We connected to PCFHub without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the PCFHub MCP server still maintained?
PCFHub is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.