# PCFHub (remote · pcfhub.dev)

Find Power Apps PCF controls, read their docs, and validate pcfhub.json manifests.

- Trust score: 69/100 (medium)
- Change this week: +2
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-20

## Components

- remote · `pcfhub.dev`: 69/100 (this document), [markdown](https://verifymcp.io/servers/pcfhub-pcfhub/pcfhub.md), [page](https://verifymcp.io/servers/pcfhub-pcfhub/pcfhub)

## Channel facts

- Endpoint: `https://pcfhub.dev/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-20.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 8 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 71/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1560 tokens (~195/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 8 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the PCFHub MCP server?

PCFHub is a hosted endpoint at https://pcfhub.dev/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http pcfhub-pcfhub 'https://pcfhub.dev/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "pcfhub-pcfhub": {
      "url": "https://pcfhub.dev/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "pcfhub-pcfhub": {
      "type": "http",
      "url": "https://pcfhub.dev/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.pcfhub-pcfhub]
url = "https://pcfhub.dev/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "pcfhub-pcfhub": {
      "type": "remote",
      "url": "https://pcfhub.dev/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add pcfhub-pcfhub --url 'https://pcfhub.dev/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  pcfhub-pcfhub:
    url: "https://pcfhub.dev/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "pcfhub-pcfhub": {
      "Transport": "http",
      "Url": "https://pcfhub.dev/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add pcfhub-pcfhub -t streamable-http -u 'https://pcfhub.dev/mcp'
```

### Other

```json
{
  "mcpServers": {
    "pcfhub-pcfhub": {
      "type": "http",
      "url": "https://pcfhub.dev/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-20 (score 69, 0)

- [security] Tool “list_components” rewrote its description, which is the text the model reads
- [security] Tool “list_taxonomy” rewrote its description, which is the text the model reads
- [cosmetic] “list_components” added an optional parameter “host”
- [cosmetic] Tool “list_taxonomy” changed its title: List categories, tags or authors → List categories, tags, authors or hosts

### 2026-09-19 (score 69, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-18 (score 68, 0)

- [functional] MCP protocol: Implements a current MCP spec version (2026-07-28).
- [functional] MCP protocol version: 2025-11-25 → 2026-07-28

### 2026-09-17 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-16 (score 67, −1)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “get_component” rewrote its description, which is the text the model reads
- [security] Tool “get_doc_page” rewrote its description, which is the text the model reads
- [security] Tool “list_components” rewrote its description, which is the text the model reads
- [security] Tool “list_doc_sections” rewrote its description, which is the text the model reads
- [security] Tool “list_releases” rewrote its description, which is the text the model reads
- [security] Tool “list_taxonomy” rewrote its description, which is the text the model reads
- [security] Tool “search” rewrote its description, which is the text the model reads
- [security] Tool “validate_manifest” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 125 → 191
- [functional improvement] Tool “get_component” now declares an output schema
- [functional improvement] Tool “get_doc_page” now declares an output schema
- [functional improvement] Tool “list_components” now declares an output schema
- [functional improvement] Tool “list_doc_sections” now declares an output schema
- [functional improvement] Tool “list_releases” now declares an output schema
- [functional improvement] Tool “list_taxonomy” now declares an output schema
- [functional improvement] Tool “search” now declares an output schema
- [functional improvement] Tool “validate_manifest” now declares an output schema
- [functional] First check of Tool coverage: 100

### 2026-09-14 (score 68, +1)

- [functional improvement] Stability: unverified → 0.03

### 2026-09-13 (score 67)

First indexed and scored.

## MCP tools (8)

### `search` (~159 tokens)

Search PCFHub

Full-text search across every published PCF control and its documentation, ranked by relevance. Use it when you know what a control should do but not what it is called; use list_components instead to filter by category, tag, author or control type, and get_component when you already have a slug. Returns control and documentation hits, each with a snippet and a URL. A query that matches nothing is an empty result rather than an error, and a misspelling may be answered with results for a corrected spelling, which the result states.

Input parameters:

- `limit` (integer): How many results to return. Defaults to 10.
- `query` (string, required): What to look for, in plain words: "barcode scanner", "kanban", "date range".

Output parameters:

- `correctedQuery` (string|null): Set only when nothing matched the query and these are results for a corrected spelling of it.
- `hits` (array)
- `query` (string): The query as it was searched.
- `total` (integer): How many results matched, which may be more than were returned.

### `list_components` (~296 tokens)

List PCF controls

Browse the PCFHub catalog by category, tag, author, control type, host or text, paged and sorted. Use it to enumerate or narrow the catalog; use search for a plain-language question about what a control should do, and get_component for one control in full. Filters take slugs, which list_taxonomy supplies. Nothing here fails on bad input: an unrecognised sort falls back to the default, and filters matching nothing return an empty page — so read `total` and `sort` from the result rather than assuming the filters applied.

Input parameters:

- `author` (string): An author slug, from list_taxonomy.
- `category` (string): A category slug, from list_taxonomy.
- `control_type` (string): field binds one column on a form; dataset renders a view; virtual is a React control; grid_customizer changes how an editable grid renders cells.
- `host` (string): Where the control has to run. A control supporting both hosts matches either.
- `page` (integer): Defaults to 1.
- `per_page` (integer): Defaults to 24; at most 48.
- `query` (string): Words to match against names, taglines and descriptions.
- `sort` (string): Defaults to relevance when there is a query, newest otherwise.
- `tags` (array): Tag slugs, from list_taxonomy. A control must carry every tag given.

Output parameters:

- `components` (array)
- `lastPage` (integer): The highest page number for these filters.
- `page` (integer): The page returned.
- `perPage` (integer)
- `sort` (string): The sort actually applied, which is the default when none was given or the one given was not recognised.
- `total` (integer): Controls matching the filters, across every page.

### `get_component` (~198 tokens)

Get a PCF control

Everything about one control by its slug: what it does, its control type, license and repository, the current release's properties, and download links for its solutions. Use it once search or list_components has given you a slug; use get_doc_page for installation and configuration instructions, which this does not return. An unknown slug, or a version the control never released, returns an error naming the tool to call instead. include_versions and include_related each cost an extra query, so leave them off unless you need the release history or similar controls.

Input parameters:

- `include_related` (boolean): Also return similar controls. Costs an extra query; leave off unless needed.
- `include_versions` (boolean): Also return every release. Costs an extra query; leave off unless needed.
- `slug` (string, required): The control's slug, e.g. "pcf-tag-list".
- `version` (string): A specific release. Defaults to the latest stable one.

Output parameters:

- `author` (object)
- `category` (object)
- `controlType` (string)
- `controlTypeDescription` (string): What that control type means, in a sentence.
- `currentVersion` (object|null): The release described, or null where nothing has been published yet.
- `downloadCount` (integer)
- `downloads` (array): Empty where the control has no published release.
- `homepageUrl` (string|null)
- `hosts` (array): Where this control runs: canvas apps, model-driven apps, or both.
- `isArchived` (boolean): True when the control is no longer maintained.
- `licenseSpdx` (string|null): SPDX identifier, e.g. "MIT".
- `name` (string)
- `publishedAt` (string|null): ISO 8601.
- `related` (array): Empty unless include_related was set.
- `repositoryUrl` (string|null)
- `slug` (string)
- `summaryMd` (string|null): The author's longer description, as Markdown.
- `supportUrl` (string|null): Where to report a problem with the control.
- `tagline` (string|null)
- `tags` (array)
- `tier` (string): free, or a paid tier.
- `url` (string): Absolute URL of the control's page, for citing.
- `versions` (array): Empty unless include_versions was set.

### `list_doc_sections` (~121 tokens)

List a control's documentation

The documentation sections one control publishes — overview, installation, canvas, model_driven, examples, limitations and so on — each with its title and URL. Use it before get_doc_page to learn which sections that control actually has; it returns no page content, and get_component covers the property reference. A control with no documentation and a slug that does not exist return the same error on purpose, so fall back to search rather than concluding the slug is wrong.

Input parameters:

- `slug` (string, required): The control's slug, e.g. "pcf-tag-list".

Output parameters:

- `sections` (array)
- `slug` (string): The control the sections belong to.

### `get_doc_page` (~149 tokens)

Read a documentation page

Read one documentation section of a control as Markdown — installation steps, canvas or model-driven configuration, examples, limitations. Use list_doc_sections first for the sections that control publishes; use get_component instead for the structured property reference. Passing a version returns the documentation pinned to that release rather than the current page. A section the control does not document returns an error pointing at list_doc_sections, and the Markdown comes back without the frontmatter the site keeps.

Input parameters:

- `section` (string, required): Which section to read.
- `slug` (string, required): The control's slug, e.g. "pcf-tag-list".
- `version` (string): Documentation pinned to a specific release. Defaults to the current documentation.

Output parameters:

- `componentName` (string)
- `componentSlug` (string)
- `contentMd` (string): The page as Markdown, with its frontmatter removed. Empty when the page has no content.
- `description` (string|null)
- `isVersionPinned` (boolean): True when a version was asked for, rather than the current documentation being returned.
- `section` (string)
- `sourceUrl` (string|null): The file in the author's repository this was compiled from.
- `title` (string)
- `updatedAt` (string|null): ISO 8601.
- `url` (string): Absolute URL of the page, for citing.
- `version` (string|null): The release this documentation describes.

### `list_taxonomy` (~118 tokens)

List categories, tags, authors or hosts

The vocabulary list_components filters by: the category tree, the tags in use, the authors with a published control, or the hosts a control can run in, each with its slug and a count. Use it to turn a name a person used into a slug; it returns no controls, so pass the slug to list_components to see them. Not paged — categories come back as a full tree and authors as a full list, while tags are capped at the 500 most used.

Input parameters:

- `kind` (string, required): Which list to return.

Output parameters:

- `items` (array)
- `kind` (string): Which list this is.

### `list_releases` (~111 tokens)

List recent releases

The most recent releases across every control on PCFHub, newest first: which control, which version, whether it is a prerelease, and when it shipped. Use it for what has changed hub-wide; for one control's own history call get_component with include_versions instead. Bounded by limit, at most 50, and not paged — there is no cursor, so it cannot walk back beyond the newest 50.

Input parameters:

- `limit` (integer): How many releases. Defaults to 20.

Output parameters:

- `releases` (array): Newest first.

### `validate_manifest` (~160 tokens)

Validate a pcfhub.json

Check a pcfhub.json against the rules PCFHub applies when it publishes a control: the schema version, the control block (namespace, constructor, type and framework), the demo's fidelity, bundle and presets, the media files it declares, and the release artifacts it expects to find. Use it while writing or reviewing that file, before a release is tagged. An invalid manifest is an ordinary result — valid false, with errors that block publishing and warnings that do not, each carrying the JSON pointer it applies to — so read the result rather than retrying. Only an empty, unreadable or oversized manifest (over 64 KB) is an error.

Input parameters:

- `manifest` (string, required): The full contents of pcfhub.json, as JSON text.

Output parameters:

- `errors` (array): Must be fixed; publishing refuses the manifest until they are.
- `schemaVersion` (string): The manifest schema version it was checked against.
- `valid` (boolean): False when there is at least one error. Warnings alone leave it true.
- `warnings` (array): Do not block publishing, but reach the author through their own CI.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/pcfhub-pcfhub/pcfhub#diagnostics

## Score history

- 2026-09-20: 69
- 2026-09-19: 69
- 2026-09-18: 68
- 2026-09-17: 68
- 2026-09-16: 67
- 2026-09-15: 68
- 2026-09-14: 68
- 2026-09-13: 67

## Common questions

### What is the PCFHub MCP server?

PCFHub is an MCP server listed in the public MCP registry as io.github.pcfhub/pcfhub. Find Power Apps PCF controls, read their docs, and validate pcfhub.json manifests. This page covers its hosted endpoint (https://pcfhub.dev/mcp).

### Is the PCFHub MCP server safe to use?

PCFHub scores 69 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the PCFHub MCP server expose?

PCFHub exposes 8 tools: search, list_components, get_component, list_doc_sections, get_doc_page, and 3 more. Their descriptions and schemas cost roughly 1,312 tokens of context every time the server is loaded.

### Does the PCFHub MCP server require authentication?

No. We connected to PCFHub without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the PCFHub MCP server still maintained?

PCFHub is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://pcfhub.dev/mcp
- Website: https://pcfhub.dev/api
- Changelog RSS feed: https://verifymcp.io/servers/pcfhub-pcfhub/pcfhub.xml
- Changelog JSON feed: https://verifymcp.io/servers/pcfhub-pcfhub/pcfhub.json
- HTML version of this page: https://verifymcp.io/servers/pcfhub-pcfhub/pcfhub