"Origin" matching MCP servers:

A thin MCP server that wraps provenance-receipts and quality-gate services as tools, enabling AI agents to certify content origin and score quality via Ed25519-signed receipts.

MCP security firewall (stdio): vet advertised tool definitions through static-scan → threat-feed → origin → pinning before they reach the model. Zero npm runtime deps. No secrets.

Enables an AI agent to drive a real Chrome instance on a hidden Windows desktop, acting on accessibility element references instead of coordinates, with each session isolated on its own private desktop, profile, and ports. Credentials are typed into a masked popup and injected by an origin-bound, DPAPI-encrypted broker, so passwords never reach the model.

Enables an MCP server to gate tools/call requests by requiring a per-send channel-policy attestation for outbound actions, checking ROPE-lite origin tags on sensitive arguments, and returning SEP-2643-shaped structured denials with retry handles and remediation hints when a call is blocked. It logs client-asserted audit context (such as turnId and userIntent) for correlation across allowed and denied calls, but never uses that receipt for allow/deny decisions.

Enables auditing or configuring a registered Linux origin as a single Cloudflare-fronted 3x-ui/Xray WebSocket node through a fixed 31-tool MCP contract.

A policy-aware Meta-MCP server that orchestrates Playwright and Chrome DevTools for secure, high-level browser automation with origin whitelists and credential redaction.