XFA MCP

XFA is a BYOD device-trust platform. This is XFA's remote Model Context Protocol server — query your organization's device posture, compliance, policies, and software/CVE status from Claude, ChatGPT, Cursor, and other AI assistants. Read-only.

This repository is the connector package for AI marketplaces. The MCP server itself is hosted by XFA at https://mcp.xfa.tech/mcp; nothing runs locally. Authentication is OAuth 2.0 (PKCE) — you sign in with your XFA account on connect.

Where it's published

Legend: ✅ live · ⏳ propagating (no action) · 🕒 pending. Update a row when its listing goes live.

Gemini note: the Gemini CLI gallery has no submission form — it crawls public repos tagged with the gemini-cli-extension GitHub topic daily (already set). Gemini CLI merged into Antigravity CLI (June 2026); Antigravity discovers MCP servers via the MCP Registry, where this server is already live, so no separate Antigravity submission is needed.

Related MCP server: fossa-mcp

Install

Cursor

One-click:

cursor://anysphere.cursor-deeplink/mcp/install?name=xfa&config=eyJ1cmwiOiJodHRwczovL21jcC54ZmEudGVjaC9tY3AifQ==

Or add to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "xfa": { "url": "https://mcp.xfa.tech/mcp" }
  }
}

Claude

Settings → Connectors → Add custom connector → URL https://mcp.xfa.tech/mcp.

ChatGPT

Settings → Connectors → Add → MCP server URL https://mcp.xfa.tech/mcp.

Gemini CLI

Install the extension:

gemini extensions install https://github.com/gl-ventures/xfa-mcp

The bundled gemini-extension.json points at the remote server; Gemini discovers OAuth from the server metadata and prompts you to sign in on first use.

VS Code / Windsurf / Zed / other MCP clients

Point the client at the remote URL https://mcp.xfa.tech/mcp (streamable HTTP / SSE, OAuth 2.0).

Tools

All tools are read-only. The live server is the source of truth — clients fetch the current tool list from the endpoint on every connection, so this list may lag the deployed server. See the Connect an AI assistant docs for the maintained reference.

Your organization (scoped to the signed-in user's org)

Software & vulnerabilities (XFA's tracked-software catalog)

Authentication

OAuth 2.0 with PKCE (S256), scope mcp:read. On connect you are redirected to XFA to authorize; no API keys or tokens are stored in this package. The client auto-discovers the OAuth endpoints from the server's already-published metadata:

• https://mcp.xfa.tech/.well-known/oauth-protected-resource

• https://mcp.xfa.tech/.well-known/oauth-authorization-server

Support

• Docs: https://docs.xfa.tech/admin/connect-ai-assistant

• Issues: https://github.com/gl-ventures/xfa-mcp/issues

• Email: support@xfa.tech

Maintainers

The MCP Registry workflow validates server.json on every change and publishes to the official MCP Registry on pushes to main (or via Run workflow). It authenticates by DNS against the v=MCPv1 TXT record on the xfa.tech apex.

To release a new version: bump version in server.json, merge to main.

Required repo secret: MCP_REGISTRY_KEY_PEM — the Ed25519 private key PEM (pairs with the DNS TXT record). Keep the matching key backed up in a password manager.

License

MIT — see LICENSE.