Independent of Jack Henry.

Evidence Desk server setup.

Tested source for declared-input preparation. Remote deployment and directory publication are separate checks.

The six tool contracts.

Tool	Explicit input	Bounded output
`inventory_gap`	Declared uses, locations, data categories, owners and evidence.	Open fields stay open. An authority mode retains principal, action, resource, expiry, revocation and shutdown owner.
`examiner_question_pack`	Declared uses, supervisory route and explicit answers with evidence references.	Eight paraphrased CSBS questions. An answer without supporting evidence remains a gap. Preparation is separate from an exam result.
`renewal_terms`	Confirmed mappings, two quotes and the same declared activity.	Totals stay in supplied order. Unknown fees and terms stay visible. Ranking and savings claims are refused.
`procedure_version`	Two supplied excerpts, their versions and the declared controlling-source basis.	Controlling-source questions and a pending reviewer line. Approval is left to the institution.
`pilot_acceptance`	Required cases, original instructions and all supplied attempts.	Failed and missing cases stay in the file. A later pass on a changed instruction leaves the original case unresolved.
`core_change_reach`	Supplied before and proposed text, filenames and candidate dependents.	Heuristic candidates and retest questions. Compilation, execution and a core connection remain outside the method.

The core-change method supports supplied Symitar PowerOn text and bank files. Every result is heuristic. Agent authority uses the inventory tool's authority mode, with no seventh tool.

Test the server locally.

Use Node 24 or later and the lockfile in the source package. The local listener binds only to 127.0.0.1.

npm ci --ignore-scripts
npm run build:schemas
npm test
npm run start:local

Tests include actual HTTP initialization and six calls through the official MCP SDK, plus restricted-data and unsupported-request refusals for every tool.

Download the tested server source. This is source code, not a Claude plugin installation.

Configure the production route.

Approve an always-on host and custom-domain route for mcp.llmsquared.com.
Configure a trusted IP rate-limit binding, TLS and disabled request-body logging.
Verify anonymous Streamable HTTP initialization, all six calls and all refusal cases on the actual custom endpoint.
Publish the Registry entry, then build and verify the Claude plugin in a supported client.

The intended endpoint is https://mcp.llmsquared.com/mcp. It is not available as a verified install route. Bluehost shared hosting remains the marketing host.

The current nameservers are on Bluehost. An apex DNS migration requires a separate decision. Website CSP and security headers are unchanged.

Processing and logs.

Tool inputs remain in request memory while the response is prepared. The code has no input store, source retrieval or model call. The calling assistant and its provider have their own processing rules.

Application audit logging is disabled by default. If enabled, only tool name, time and status are emitted. The host uses short-lived IP-derived counters for rate limiting. Platform metadata and retention require verification before remote release.

Read Evidence Desk processing.

Directory and plugin checks.

MCP Registry: not listed
Claude Connectors: not listed
OpenAI directory: not listed
Glama: not listed
Smithery: not listed

A downloaded package, a successful client call, a submission and a live listing are separate milestones. Claude package installation and skill invocation have not been completed.

The review boundary.

A review prepares a file. It does not certify compliance, give a legal opinion or connect to a core.

Support: info@llmsquared.com.