MCP Bill of Materials
A machine-readable inventory of what this server exposes and depends on: tools with their effects, transports, packages, findings and provenance (schema version 1.0). Third-party text in it is escaped. Also available from the REST API at /api/v1/servers/5819f75f-72d4-4060-b6e3-b39cee6cab63/mcbom.
MCP Bill of Materials
root{21}
schema_version: "1.0"
bom_format: "squatch-mcbom"
generator{3}
name: "squatch-mcp"
classifier_version: "rules_v1@2026-10-11.1"
unicode_version: "18.0.0"
server{7}
name: "dev.xpansion/xfms"
title: "XF Model Source"
description: "Find the right AI model for your job. Free discovery and ranking; tests on your own key."
version: "0.5.3"
homepage_url: "https://xpansion.dev/xfms"
source: "official_registry"
upstream_status: "active"
publisher{4}
namespace: "dev.xpansion"
display_name: "dev.xpansion"
type: "registry_namespace"
status: "unclaimed"
organization: null
repository{5}
url: "https://github.com/VisionAIrySE/XFMS"
provider: "github"
owner: "VisionAIrySE"
name: "XFMS"
verified: false
packages[0]
transports[1]
0{5}
kind: "remote"
type: "streamable-http"
endpoint_url: "https://xfms.xpansion.dev/mcp"
endpoint_host: "xfms.xpansion.dev"
auth_type: "none"
auth{3}
type: "none"
authorization_servers[0]
scopes[0]
protocol{4}
era: "legacy"
negotiated_version: "2025-11-25"
supported_versions[0]
transport_type: "streamable-http"
tools[7]
0{9}
name: "benchmark"
title: "Test the shortlist on the person's own work"
effect: "EXECUTE"
effect_confidence: 0.703
capabilities[1]
0{2}
capability: "PERSONAL_DATA"
confidence: 0.827
risk_severity: "HIGH"
fingerprint: "1135c9448ea968815f1b11d2f6560681c97ec68b8643db06ac2f600be7d63dfd"
input_schema_fingerprint: "14b7cc6b7bf1b3413dc3f3cc53cbc6cd6cd3c1e522db2542e75091db6e9ddeca"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: true
1{9}
name: "compare"
title: "Test models the person named on their own work"
effect: "READ"
effect_confidence: 0.857
capabilities[1]
0{2}
capability: "PERSONAL_DATA"
confidence: 0.827
risk_severity: "LOW"
fingerprint: "4e1819bef297a0aa01375446f2c964253d4a4e066a3ae02336b6e8bc05b44aad"
input_schema_fingerprint: "625915f0377dd4bdec9d2a4a4f003aa382f1bf4872819bbe745a3dd08fcbf636"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: true
2{9}
name: "discover"
title: "Work out what the job really needs"
effect: "READ"
effect_confidence: 0.798
capabilities[1]
0{2}
capability: "PERSONAL_DATA"
confidence: 0.808
risk_severity: "LOW"
fingerprint: "2ff97388f452279ed9c56cb4b8336a0b6994c12b432f6fffbb5c967432cebd6e"
input_schema_fingerprint: "0ec838742f3e62b695ee8ecb6e96ed93670e7f996b0623375c6ab2d2c76f39e8"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: true
3{9}
name: "field_results"
title: "What has worked for jobs like this"
effect: "READ"
effect_confidence: 0.422
capabilities[0]
risk_severity: "INFO"
fingerprint: "651fb515a60ecb483ff286f7e37dc6ed5ee545a3c43affbf92b368af1dec0d1b"
input_schema_fingerprint: "5a796d70668b832eb7eba69d85895ac22e244b718ce8037b2b4c44f07be9dfba"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: true
4{9}
name: "pick"
title: "Pick the best model for a discovered job"
effect: "READ"
effect_confidence: 0.422
capabilities[0]
risk_severity: "INFO"
fingerprint: "87828516547c94ececee95e19391c9cdfdd261821c1097013dba5b6c7224db70"
input_schema_fingerprint: "6d4c646de809301e3ed966b6d3d27f11c8de1f4cc6d118573c05574d11e3baa3"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: true
5{9}
name: "rank"
title: "Rank models for a discovered job"
effect: "READ"
effect_confidence: 0.879
capabilities[0]
risk_severity: "INFO"
fingerprint: "874e75bc27087dc9fc4a5854436993419da0793eb3713254115959cb4d5544b6"
input_schema_fingerprint: "6d4c646de809301e3ed966b6d3d27f11c8de1f4cc6d118573c05574d11e3baa3"
annotations{5}
title: null
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: true
6{9}
name: "watch_job"
title: "Watch this job (XF Model Watch subscribers)"
effect: "WRITE"
effect_confidence: 0.603
capabilities[1]
0{2}
capability: "PERSONAL_DATA"
confidence: 0.76
risk_severity: "LOW"
fingerprint: "290ee4c9ee1908e354f800fca978af2f87bc503ebcf62c170acacbad894dc3a2"
input_schema_fingerprint: "4c0e12235410b92543fa3fcd5751389a02a47a8cdbd03c8b0ca45cd37dfa8c80"
annotations{5}
title: null
readOnlyHint: false
destructiveHint: false
idempotentHint: false
openWorldHint: false
resources[0]
prompts[0]
extensions[0]
data{6}
privacy_completeness: "not_provided"
data_categories[0]
ai_training: null
retention_policy: null
processing_regions[0]
subprocessors[0]
external_integrations[1]
0{3}
host: "xfms.xpansion.dev"
registrable_domain: "xpansion.dev"
source: "transport"
findings[10]
0{6}
check_id: "SQ-SERVER-AUTH-NONE-WRITE"
category: "authentication"
severity: "MEDIUM"
title: "State-changing tools available without authentication"
subject_type: "server"
subject_name: null
1{6}
check_id: "SQ-TOOL-ANNOTATION-UNDERCLAIM"
category: "annotations"
severity: "MEDIUM"
title: "Annotations understate what the tool does"
subject_type: "tool"
subject_name: "benchmark"
2{6}
check_id: "SQ-TOOL-EXFIL-SHAPED-PARAM"
category: "schema"
severity: "INFO"
title: "Free-text parameter commonly used to collect conversation data"
subject_type: "tool"
subject_name: "benchmark"
3{6}
check_id: "SQ-TOOL-EXFIL-SHAPED-PARAM"
category: "schema"
severity: "INFO"
title: "Free-text parameter commonly used to collect conversation data"
subject_type: "tool"
subject_name: "compare"
4{6}
check_id: "SQ-TOOL-EXFIL-SHAPED-PARAM"
category: "schema"
severity: "INFO"
title: "Free-text parameter commonly used to collect conversation data"
subject_type: "tool"
subject_name: "discover"
5{6}
check_id: "SQ-TOOL-EXFIL-SHAPED-PARAM"
category: "schema"
severity: "LOW"
title: "Free-text parameter commonly used to collect conversation data"
subject_type: "tool"
subject_name: "pick"
6{6}
check_id: "SQ-TOOL-EXFIL-SHAPED-PARAM"
category: "schema"
severity: "LOW"
title: "Free-text parameter commonly used to collect conversation data"
subject_type: "tool"
subject_name: "rank"
7{6}
check_id: "SQ-TOOL-EXFIL-SHAPED-PARAM"
category: "schema"
severity: "INFO"
title: "Free-text parameter commonly used to collect conversation data"
subject_type: "tool"
subject_name: "watch_job"
8{6}
check_id: "SQ-TOOL-INJECTION-INSTRUCTIONS"
category: "prompt_injection"
severity: "MEDIUM"
title: "Instructions addressed to the AI model"
subject_type: "tool"
subject_name: "benchmark"
9{6}
check_id: "SQ-TOOL-TITLE-EFFECT-MISMATCH"
category: "deceptive_metadata"
severity: "HIGH"
title: "Display title describes a lower-impact action than the name"
subject_type: "tool"
subject_name: "benchmark"
trust{9}
registry_namespace: "verified_upstream"
publisher_identity: "unverified"
organization: "unverified"
domain: "unverified"
repository: "unverified"
source_provenance: "unknown"
security_scan: "findings_detected"
privacy_transparency: "not_provided"
monitoring: "active"
provenance{4}
registry_name: "dev.xpansion/xfms"
registry_content_sha256: "b5dc2419c16ee4e1a87a90c83e734cf257a979e2c58cefe9ab398fe3c24eb6db"
scan_snapshot_fingerprint: "4884b5493810ac83772ae84d8789c159d3b0b33237dec3fcc62a023a8a3bcb85"
scanner_version: "1.0.0"
timestamps{4}
generated_at: "2026-11-15T03:51:08.599Z"
observed_at: "2026-11-10T07:26:11.112+00:00"
registry_published_at: "2026-10-17T02:41:17.324+00:00"
registry_updated_at: null