👑

MCP QUEEN

Architecture and trust boundaries

MCP Queen is an evidence and discovery layer between the public MCP ecosystem and a developer's connection decision. It observes public surfaces and publishes dated evidence. It does not certify security, authorize a server, proxy the selected connection, or inspect private data behind credentials.

System at a glance

1. Public inputs

Official MCP Registry metadata, public remote endpoints, public repositories, authoritative evidence sources, and reviewed field reports.

2. Observation pipeline

Registry sync, bounded protocol probes, deterministic grading, safe read-only response audits, and human moderation.

3. Evidence store

Server metadata, observed tools, probe history, grades, separate trust observations, response benchmarks, and quarantined feedback.

4. Read surfaces

MCP tools, evidence pages, Trust Receipts, JSON APIs, reports, datasets, and operational-grade badges.

Public inputs → bounded observations → dated evidence → human or agent review → a separate direct connection to the selected server.

The boundaries that matter

Boundary	Inside MCP Queen	Outside MCP Queen
Discovery	Indexes public registry metadata and tool catalogs observed through `tools/list`.	Does not endorse, install, or authorize a discovered server.
Operational probes	Uses bounded public `initialize` and capability-discovery requests, records latency and verbatim observations, and marks auth-gated dimensions provisional.	Does not bypass authentication or infer private tool behavior.
Operational grade	Summarizes observed reachability, protocol behavior, tool metadata, latency, and provenance using a deterministic rubric.	Is not a security, privacy, compliance, or data-quality certification.
Trust Receipt	Keeps dated security/access, data-integrity, citation, claim, response-benchmark, and reviewed field evidence separate.	Missing evidence remains unaudited; it is never converted into a pass.
Connection	Returns a server's published endpoint and available evidence.	The developer or agent decides whether to connect and then connects directly. MCP Queen is not a proxy in that data path.
Feedback	`submit_feedback` accepts factual reports only after real use and places them in a quarantined review queue.	Reports do not auto-publish, count as votes, or directly change operational grades.

Runtime components

Cloudflare Worker: public HTML, JSON APIs, the remote MCP endpoint, scheduled registry sync, and bounded probes.
D1 evidence store: public registry observations, probe history, separate evidence dimensions, benchmarks, and quarantined feedback.
Static assets: the landing page, icons, datasets, captions, and other public files.
Key-gated operator routes: maintenance controls that are not MCP tools and are not part of the public discovery surface.

Developer decision flow

Find a server by task or search the observed tool catalog through MCP.
Inspect the server's dated operational observations and whether any dimensions are provisional.
Review the separate Trust Receipt and label missing dimensions unaudited.
Evaluate the selected server's own permissions, terms, credentials, and data handling.
Connect directly only after that separate decision.

Continue with the integration guides, the tool reference, or the detailed operational methodology. Repository implementation notes are in docs/architecture.md.