Carvector Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Carvector Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Give your AI agent real vehicle data. An MCP server that lets Claude, Cursor, ChatGPT, or any MCP-capable client query the CarVector API natively — vehicle specs, representative images, federal recalls, owner complaints, service bulletins, defect investigations, and OBD-II diagnostic trouble codes.
Models hallucinate car data. They invent horsepower numbers, miss recalls filed last week, and guess at what a trouble code means. carvector-mcp gives your agent structured, sourced answers it can cite instead of a confident guess.
npx -y carvector-mcp --key cv_your_key · MIT · Free tier, no card → carvector.io
1. Get a free API key at carvector.io — 500 requests a month, no credit card.
2. Add it to your MCP client. Most clients use an mcpServers block:
{
"mcpServers": {
"carvector": {
"command": "npx",
"args": ["-y", "carvector-mcp"],
"env": { "CARVECTOR_API_KEY": "cv_your_key" }
}
}
}That's it. Restart your client and ask it about a vehicle.
Prefer a remote server? If your client supports HTTP MCP, skip the install and point it straight at the hosted endpoint: ``json { "mcpServers": { "carvector": { "url": "https://api.carvector.io/v1/mcp", "headers": { "Authorization": "Bearer cv_your_key" } } } } ``| Tool | What it returns |
|---|---|
search_vehicles | Matching vehicles by year / make / model, with ids + specs |
get_vehicle | Full specs for one vehicle — engine, drivetrain, body, image, recall count |
get_recalls | Federal recall campaigns for a vehicle — component, summary, consequence, remedy |
get_complaints | Owner-complaint signal for a vehicle — aggregate by component + the most recent complaints (Pro plan) |
get_tsbs | Manufacturer service-bulletin index for a vehicle — the fix the dealer already knows about (Business plan) |
get_investigations | Federal defect investigations for a vehicle — a leading indicator of recalls (Business plan) |
lookup_dtc | An OBD-II code's title, category, severity, and safety/emissions flags |
The agent chains them naturally: search_vehicles to resolve an id, then get_vehicle, get_recalls, get_complaints, get_tsbs, or get_investigations.
You: "Is a P0300 code serious?"
→ carvector.lookup_dtc({ code: "P0300" })
{
"code": "P0300",
"title": "Random/Multiple Cylinder Misfire Detected",
"category": "Powertrain",
"severity": "High",
"safety_risk": true,
"emissions_related": true
}Your agent answers: "Yes — P0300 is a high-severity, safety-related misfire code. Don't keep driving on it." Sourced, not guessed.
The CarVector HTTP API also accepts x402 payments, so an agent with a wallet can call it with no account, no signup and no API key — it pays per request and gets the data back.
(USDC 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913)
pay and retry:
curl -i "https://carvector.io/v1/vehicles?year=2020&make=Ford&model=F-150"
# HTTP/1.1 402 Payment Required
# { "x402Version": 1, "accepts": [ { "scheme": "exact", "network": "base", ... } ] }Payable endpoints: /v1/vehicles, /v1/vehicles/:id, /v1/vehicles/:id/recalls, /v1/vehicles/:id/complaints, /v1/vehicles/:id/tsbs, /v1/vehicles/:id/investigations, /v1/dtc/:code.
This MCP client does not pay — it uses an API key.carvector-mcprequiresCARVECTOR_API_KEYand exits without one. x402 is for calling the HTTP API directly. If you want keyless access from an agent, call the endpoints above rather than going through this package.
carvector-mcp is an open-source, thin client. It bundles no data — every call forwards to the CarVector API, authenticated with your key. What you get back:
Calls count against your plan's rate limit and show up in your dashboard, exactly like a REST request.
This client is ~150 lines of readable JavaScript — please read them. It:
api.carvector.io (grep index.js, it's the only URL),Bearer header to that host, nowhere else,@modelcontextprotocol/sdk.Your key stays on your machine. Set it via the CARVECTOR_API_KEY env var (preferred); --key works too but, like any CLI argument, is visible in process listings.
MIT. The client is open source; the data is served by CarVector.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.