.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/cdc-health-mcp-server</h1> <p><b>Search and query CDC public health data — mortality, vaccinations, surveillance, behavioral risk (Socrata SODA API) via MCP. STDIO or Streamable HTTP.</b> <div>3 Tools • 2 Resources • 1 Prompt</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://cdc.caseyjhand.com/mcp
</div>
Three tools for discovering and querying CDC public health data:
| Tool | Description |
|---|---|
cdc_discover_datasets | Search the catalog by keyword, category, or tag. Entry point for all queries. |
cdc_get_dataset_schema | Fetch column schema, row count, and metadata for a dataset. Essential before writing SoQL queries. |
cdc_query_dataset | Execute SoQL queries — filter, aggregate, sort, full-text search, and field selection. |
cdc_discover_datasetsSearch the CDC dataset catalog to find relevant datasets.
["covid19", "surveillance"])cdc_get_dataset_schema for the full column listdomain selects the portal: data.cdc.gov (default) or chronicdata.cdc.govcdc_get_dataset_schemaFetch the full column schema for a specific dataset.
$where clausesbi63-dtpu)domain selects the portal hosting the dataset: data.cdc.gov (default) or chronicdata.cdc.govcdc_query_datasetExecute SoQL queries against any CDC dataset.
$select, $where, $group, $having, $order$qdomain selects the portal hosting the dataset: data.cdc.gov (default) or chronicdata.cdc.gov| Type | Name | Description |
|---|---|---|
| Resource | cdc://datasets | Top 50 datasets by popularity for orientation |
| Resource | cdc://datasets/{datasetId} | Dataset metadata and column schema (equivalent to schema tool) |
| Prompt | analyze_health_trend | Guided 5-step workflow: discover, inspect, baseline query, compare, synthesize |
Built on @cyanheads/mcp-ts-core:
none, jwt, oauth)in-memory, filesystem, Supabase, Cloudflare KV/R2/D1CDC-specific:
domain input — data.cdc.gov (default) and chronicdata.cdc.gov (PLACES small-area estimates, the Heart Disease & Stroke Atlas, Environmental Public Health Tracking); restricted to this allowlistA public instance is available at https://cdc.caseyjhand.com/mcp — no installation required. Point any MCP client at it via Streamable HTTP:
{
"mcpServers": {
"cdc-health-mcp-server": {
"type": "streamable-http",
"url": "https://cdc.caseyjhand.com/mcp"
}
}
}Add the following to your MCP client configuration file.
{
"mcpServers": {
"cdc-health-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/cdc-health-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"cdc-health-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/cdc-health-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with Docker:
{
"mcpServers": {
"cdc-health-mcp-server": {
"type": "stdio",
"command": "docker",
"args": ["run", "-i", "--rm", "-e", "MCP_TRANSPORT_TYPE=stdio", "ghcr.io/cyanheads/cdc-health-mcp-server:latest"]
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http
# Server listens at http://localhost:3010/mcpgit clone https://github.com/cyanheads/cdc-health-mcp-server.gitcd cdc-health-mcp-serverbun installAll configuration is validated at startup via Zod schemas in src/config/server-config.ts. Key environment variables:
| Variable | Description | Default |
|---|---|---|
MCP_TRANSPORT_TYPE | Transport: stdio or http | stdio |
MCP_HTTP_PORT | HTTP server port | 3010 |
MCP_AUTH_MODE | Authentication: none, jwt, or oauth | none |
MCP_LOG_LEVEL | Log level (debug, info, warning, error, etc.) | info |
LOGS_DIR | Directory for log files (Node.js only) | <project-root>/logs |
STORAGE_PROVIDER_TYPE | Storage backend: in-memory, filesystem, supabase, cloudflare-kv/r2/d1 | in-memory |
CDC_APP_TOKEN | Socrata app token for higher rate limits | none |
CDC_BASE_URL | Base URL for SODA API requests | https://data.cdc.gov |
CDC_CATALOG_URL | Base URL for Socrata Discovery API | https://api.us.socrata.com/api/catalog/v1 |
OTEL_ENABLED | Enable OpenTelemetry instrumentation (spans, metrics, completion logs) | false |
# One-time build
bun run rebuild
# Run the built server
bun run start:http
# or
bun run start:stdio bun run devcheck # Lints, formats, type-checks, and more
bun run test # Runs the test suite| Directory | Purpose |
|---|---|
src/mcp-server/tools | Tool definitions (*.tool.ts). Three CDC data tools. |
src/mcp-server/resources | Resource definitions. Catalog overview and dataset detail. |
src/mcp-server/prompts | Prompt definitions. Health trend analysis workflow. |
src/services/socrata | Socrata SODA API service layer — HTTP client, catalog search, metadata, queries. |
src/config | Server-specific environment variable parsing and validation with Zod. |
See CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for logging, ctx.state for storagecreateApp() arraysIssues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testThis project is licensed under the Apache 2.0 License. See the LICENSE file for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.