# com.dpf-it/mcp-server AI-powered data integration platform. Onboard users and run DPF data workflows. - **Type:** MCP server - **Trust:** 60/100 (B), scored on the content rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 1.0.0 - **Author:** com.dpf-it - **License:** Unknown - **Endpoints:** streamable-http https://api.dpf-it.com/mcp - **Source:** https://api.dpf-it.com/mcp - **Endpoint health:** reachable (last checked 2026-09-17T17:16:33.230Z, 4 samples) — uptime is not a security property and is not part of the trust score - **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport) ## Trust 60/100 (B), scored on the content rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: clean - Obfuscation scan: clean - Evidence age: 1 day ## Security scan - **Status:** clean - **Scanned:** 2026-09-17T17:16:33.230Z - **Version scanned:** live - **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it. **Findings** - injection-shaped content (note) in the `call_dpf_api` tool: Links to undeclared domain: dpf-it.com ## Tools 18 declared. Observed from a live `tools/list` probe. - `list_my_workspaces` — List every workspace the authenticated user has access to, including their permission on each. - `create_workspace` — Create a new workspace, owned by the authenticated user. Use this if list_my_workspaces returns none. - `list_data` — List either the data specs (parsing + mapping rule sets, resource: "specs") or the data processing jobs (executions of a spec, resource: "jobs") defined in a wo - `get_status` — Poll the status of either a data spec's own process (schema inference + code generation, run by start-analysis — pass specId, reaches "ready" or "failed") or a - `delete_data_spec` — Permanently delete a data spec and its associated configuration. - `submit_query` — Run a SQL query against the Iceberg tables loaded into a workspace. To list the tables that actually exist in the workspace, run `SHOW TABLES` — this is the aut - `manage_connection` — Create, list, test, or delete a workspace connection to an external data source. Two types are supported: "sftp" and "aws_s3". For sftp, create generates a keyp - `manage_trigger` — Create, list, update, delete, or fire a workspace job trigger. Four types: - "sftp"/"aws_s3": pulls files from a connection (sftp: remote server; aws_s3: S3 buc - `onboard_data_source` — First step of setting up a new data integration: creates a data spec. By default (sourceType "file") this returns presigned upload URL(s) for the sample file (a - `finish_data_source_onboarding` — Call after uploading the file(s) returned by onboard_data_source — kicks off AI analysis and waits until the spec reaches "ready" or "failed". If it returns bef - `update_data_spec` — Change an existing data spec's configuration. If no replacement file names are given, this runs synchronously (no upload needed): saves changes and — by default - `finish_data_spec_update` — Call after uploading the file(s) returned by update_data_spec — kicks off AI analysis and waits until the spec reaches "ready" or "failed". If it returns before - `run_data_job` — First step of processing new data files through an already-configured data spec: creates a job and returns presigned upload URL(s) for each file. Upload the fil - `finish_data_job` — Call after uploading the file(s) returned by run_data_job — starts processing and waits until the job completes or fails. If it returns before that (timedOut: t - `setup_scheduled_pull` — End-to-end workflow for "pull files from this SFTP server / S3 bucket on a schedule" requests: reuses a matching connection if one already exists in the workspa - `call_dpf_api` — Escape hatch for DPF capabilities that don't have a dedicated tool yet. ALWAYS prefer a dedicated tool when one exists — get_status, list_data, submit_query, de - `manage_account` — Returns instructions for creating a DPF account, verifying its email, resending the verification code, or resetting a forgotten password — it never performs the - `contact` — Send a message to the DPF team — request a demo, ask about licensing, report an issue, or request a feature. No authentication required. Always ask the user for ## Install **Verdict: review** — Installable, but 2 things to check first: No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. **Cautions** (coverage gaps and advisories — never blocking) - No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"mcp-server\": {\n \"type\": \"http\",\n \"url\": \"https://api.dpf-it.com/mcp\"\n }\n }\n}" ``` ## Blast radius Moderate to extensive — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: deletes data; runs on someone else's infrastructure. - Floor 32, ceiling 56 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/com.dpf-it%2Fmcp-server - Install plan: https://forgeregistry.com/api/v1/packages/com.dpf-it%2Fmcp-server/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/com.dpf-it%2Fmcp-server - HTML page: https://forgeregistry.com/registry/com.dpf-it%2Fmcp-server - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.