What’s MCP Federation?

The Model Context Protocol (MCP) standardized how a tool talks to an agent. It did not answer the operational questions that decide whether you can actually ship: Which server do I trust? How do I attach it safely? What happens when a destructive tool is one prompt away from production?

FrootAI federation is the layer that answers them. It turns any MCP server into a trusted, namespaced, policy-governed tool surface your agents and solution plays can attach with a single declaration.

The three problems federation solves

Problem	Raw MCP	FrootAI federation
Trust	Anyone can publish a server	Every server carries a trust tier backed by reviewable evidence
Namespacing	Tool names collide across servers	Tools are surfaced under a stable `namespace.tool` prefix
Policy	Destructive tools run unguarded	The trust policy governs attach-without-prompt and destructive calls

How it works

When you attach a server through FrootAI, the federation router (frootai-mcp) sits between your agent and the upstream server:

Resolve — the router looks up the server’s spec and trust tier.
Govern — the trust policy decides whether the server attaches silently, prompts, or is blocked, and whether its destructive tools are allowed.
Namespace — the upstream tools are exposed under the server’s prefix so names never collide.
Meter — usage is attributed per publisher for transparent accounting.


{ "mcpServers": { "frootai": { "command": "npx", "args": ["-y", "frootai-mcp", "--attach", "playwright"] } } }

That one line attaches the upstream server through FrootAI — trust policy and namespacing included. You can always copy the direct-upstream form too, but you lose the governance.

Four trust tiers

Every server in the marketplace is classified into one of four tiers. The tier controls how the server is allowed to attach and run:

First-party (Microsoft) — published by Microsoft or a Microsoft-owned org.
Verified publisher — identity-verified third party with a reviewed evidence file.
Community — community-published; review before granting access.
Untrusted — unverified or flagged; sandbox only.

Read the full criteria, evidence model, and promotion process in Trust Tiers.

Start here

Browse the marketplace — every federated server with its trust badge, install count, and mcp.json blocks.
Trust Tiers — how publishers are classified and how to read the evidence behind every verified badge.

Federation is the difference between a tool that works on your laptop and a tool surface you can trust in production.