About
Navigator for BPC Agentic Procurement
Remote endpoints: streamable-http: https://mcp.cpghumanintheloop.ai/mcp
Security Report
This is a well-architected human-in-the-loop MCP server with clean separation of concerns and proper credential handling. The server routes all tool invocations to human review via a Postgres backend, enforcing no autonomous decision-making. Minor code quality issues (broad exception handling, lack of input validation for some database operations) and permissive SSL defaults prevent a higher score, but no security vulnerabilities or dangerous patterns were identified. Supply chain analysis found 4 known vulnerabilities in dependencies (0 critical, 3 high severity).
3 files analyzed · 9 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
Permissions Required
This plugin requests these system permissions. Most are normal for its category.
How to Install & Connect
Available as Local & Remote
This plugin can run on your machine or connect to a hosted endpoint. during install.
Documentation
View on GitHubFrom the project's GitHub README.
MCP CPG Human in the Loop (HITL)
Surface role: TRANSACTION — one of the four GSC surfaces (data · discovery · transaction · standards).
Lodge an RFQ, request terms, or escalate — a human answers every ticket. ACM-451 ESCALATE is served here.
| Canonical endpoint | https://mcp.cpghumanintheloop.ai/mcp (streamable-http) |
| Website | https://cpghumanintheloop.ai |
| Registry listing | io.github.greencore-solutions/cpg-human-in-the-loop v1.0.0 |
| Operator | GreenCore Solutions Corp. — Microsoft AI Cloud Partner |
| Protocol | ACM-68000 · sovereign manifest SM-ECO-10060 |
Registry tile text (verbatim)
Title: MCP CPG Human in the Loop (HITL) Description: Navigator for BPC Agentic Procurement
What it serves
Four MCP tools — submit_rfq, check_rfq_status, request_terms, escalate.
Every ticket routes to a human. Human-in-the-Loop on every purchase order:
machine discovery, human confirmation.
Releases
| tag | source | deployed image digest |
|---|---|---|
v1.0.0 | 6004ce5 | sha256:40893539be16 |
Data plane and secret hygiene
Additive hitl.* schema on the shared Postgres (hitl.tickets); kg.* and
gtins.* are untouched by this service.
The connection string lives ONLY as a Container App secret. It is never
committed, never written into deploy files, never echoed, and never logged.
Application code reads process.env.DATABASE_URL and nothing else — see
server.js and console.js. Deploy docs reference the DSN as a placeholder
only. Verified by a full-history credential scan: zero literal secret values.
The four surfaces
| surface | endpoint |
|---|---|
| data | https://mcp.cpgknowledgegraph.ai |
| discovery | https://mcp.gsc-fleet.ai |
| transaction | https://mcp.cpghumanintheloop.ai |
| standards | https://mcp.cpgagentprotocols.ai |
Licensing
No license file is committed. GSC MCP server code is under a hybrid MIT + Commercial Enterprise arrangement; the counsel-drafted terms are pending. Until they land, absence of a LICENSE file is deliberate — not an oversight.
Reviews
No reviews yet
Be the first to review this server!
More Developer Tools MCP Servers
Git
Freeby Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
Fetch
Freeby Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
Toleno
Freeby Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
mcp-creator-python
Freeby mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
MCP Marketplace
Freeby mcp-marketplace · Developer Tools
Search and install MCP servers from inside your AI client.
MarkItDown
Freeby Microsoft · Content & Media
Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption