About
Navigator for BPC Agentic Procurement
Remote endpoints: streamable-http: https://mcp.cpghumanintheloop.ai/mcp
Security Report
This is a well-designed human-in-the-loop transaction MCP with solid security practices. The server properly isolates secrets (DATABASE_URL stored only as env var, never logged), implements input validation via Zod schemas, and has appropriate scoping (four tools that all route to human review with no autonomous decisions). Minor code quality observations exist but do not materially impact security. Supply chain analysis found 4 known vulnerabilities in dependencies (0 critical, 3 high severity).
4 files analyzed · 8 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
Permissions Required
This plugin requests these system permissions. Most are normal for its category.
How to Install & Connect
Available as Local & Remote
This plugin can run on your machine or connect to a hosted endpoint. during install.
Documentation
View on GitHubFrom the project's GitHub README.
MCP CPG Human in the Loop (HITL)
Surface role: TRANSACTION — one of the four GSC surfaces (data · discovery · transaction · standards).
Lodge an RFQ, request terms, or escalate — a human answers every ticket. ACM-451 ESCALATE is served here.
| Canonical endpoint | https://mcp.cpghumanintheloop.ai/mcp (streamable-http) |
| Website | https://cpghumanintheloop.ai |
| Registry listing | io.github.greencore-solutions/cpg-human-in-the-loop v1.0.0 |
| Operator | GreenCore Solutions Corp. — Microsoft AI Cloud Partner |
| Protocol | ACM-68000 · sovereign manifest SM-ECO-10060 |
Registry tile text (verbatim)
Title: MCP CPG Human in the Loop (HITL) Description: Navigator for BPC Agentic Procurement
What it serves
Four MCP tools — submit_rfq, check_rfq_status, request_terms, escalate.
Every ticket routes to a human. Human-in-the-Loop on every purchase order:
machine discovery, human confirmation.
Releases
| tag | source | deployed image digest |
|---|---|---|
v1.0.0 | 6004ce5 | sha256:40893539be16 |
Data plane and secret hygiene
Additive hitl.* schema on the shared Postgres (hitl.tickets); kg.* and
gtins.* are untouched by this service.
The connection string lives ONLY as a Container App secret. It is never
committed, never written into deploy files, never echoed, and never logged.
Application code reads process.env.DATABASE_URL and nothing else — see
server.js and console.js. Deploy docs reference the DSN as a placeholder
only. Verified by a full-history credential scan: zero literal secret values.
The four surfaces
| surface | endpoint |
|---|---|
| data | https://mcp.cpgknowledgegraph.ai |
| discovery | https://mcp.gsc-fleet.ai |
| transaction | https://mcp.cpghumanintheloop.ai |
| standards | https://mcp.cpgagentprotocols.ai |
Licensing
No license file is committed. GSC MCP server code is under a hybrid MIT + Commercial Enterprise arrangement; the counsel-drafted terms are pending. Until they land, absence of a LICENSE file is deliberate — not an oversight.
Reviews
No reviews yet
Be the first to review this server!
More Developer Tools MCP Servers
Paperclip
Freeby Paperclipai · Developer Tools
Trending hip-hop artist momentum scores across four cultural dimensions.
Fetch
Freeby Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
Git
Freeby Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
Toleno
Freeby Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
MCP Marketplace
Freeby mcp-marketplace · Developer Tools
Search and install MCP servers from inside your AI client.
mcp-creator-python
Freeby mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.