Know what you are connecting.
Discover MCP servers from the official registry, inspect their published manifests and preserve source provenance. Discovery is not certification, and a score is never runtime permission.
Discovery pipeline
Official registry → source observation → candidate/release identity → capability manifest → evidence collection → deterministic evaluation → suitability → CAFI authorization.
System boundary
mcPIE provides intelligence. CAFI retains runtime identity, access, policy and execution authority. UCASMA owns credential lifecycle.
Official MCP Registry
Browse published server releases. Source metadata is preserved; evaluation fields are intentionally empty.
| Server / release | Publisher / source | Published status | Assessment |
|---|---|---|---|
| Loading live source… | |||
Stored inventory
Source observations persisted in the T4H Cloudflare D1 database. Stored observations are not evaluations or certifications.
| Server / release | Last observed | Evaluation | Source hash |
|---|
Recent acquisition receipts
| Run | Observed | Rows | Response hash |
|---|
Best-Practice Production Profile v1.0
Assessment quality, risk cap, evidence confidence and admission gates are separate outputs. An unresolved gate or control mapping prevents production approval.
Production admission gates
Integration boundaries
mcPIE
Discovery, source provenance, capability mapping, evaluation evidence, benchmarks, suitability, harvesting, adoption planning and drift detection.
CAFI
Runtime identity, authorization, policy decisions, approvals, execution routing and runtime receipts. mcPIE scores never grant access.
UCASMA / KeyForge
Credential issuance, custody, renewal, rotation and revocation. mcPIE may retain opaque references only, never plaintext credentials.
MIRI / MIMIR
Identity/context integration remains unconnected until the canonical product name, owner and interface contract are verified.
Forge / Reality Ledger
Intended durable evidence and decision ledger. Not connected in this deployment; local receipts are not represented as ledger receipts.
Runtime
Untrusted servers require isolated, bounded trials. No discovered server is installed or invoked by mcPIE.