.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/college-scorecard-mcp-server</h1> <p><b>Search, compare, and analyze U.S. college data — costs, earnings, programs, and outcomes — via MCP. STDIO or Streamable HTTP.</b> <div>9 Tools • 2 Resources • 1 Prompt</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
9 tools for working with U.S. Department of Education College Scorecard data — institution search, program-level earnings, cost and outcomes analysis, and structured comparison:
| Tool | Description |
|---|---|
scorecard_search_schools | Search and filter institutions by name, location, type, size, and acceptance rate range. Returns core identity and cost metrics. |
scorecard_get_school | Full institutional profile for one or more school IDs — costs, admissions, outcomes, aid, demographics, and completion rates. |
scorecard_compare_schools | Normalized side-by-side comparison of 2–5 schools on a named topic. Returns percentile-ranked rows and relative deltas within the result set. |
scorecard_get_programs | All field-of-study programs at one school: 1-year post-graduation earnings (P25/median/P75), debt at graduation, and enrollment figures. |
scorecard_search_programs | Find programs by CIP code or keyword across all institutions, ranked by median earnings. Accepts school-side filters (state, ownership, max cost). |
scorecard_get_earnings | Institution-level post-graduation earnings for one school — median and percentiles at 6, 8, and 10 years after entry, with optional gender breakdown. |
scorecard_value_analysis | Workflow tool: parallel-fetches cost, debt, repayment, and earnings data, then computes ROI metrics — debt-to-earnings ratio, net price by income bracket, and peer comparisons. |
scorecard_lookup_cip | Search Classification of Instructional Programs (CIP) codes by keyword or partial name. Served from embedded static data — no API call or rate-limit impact. |
scorecard_list_fields | Search the Scorecard field catalog by keyword. Returns matching field paths, descriptions, data types, and sort support. Use before passing custom fields parameters. |
scorecard_search_schoolsSearch for institutions using name, location, and institutional filters.
per_page up to 100, zero-indexed page)scorecard_get_schoolFetch a full institutional profile by school ID.
fields override for callers who need a narrower or broader field setscorecard_compare_schoolsscorecard_compare_schoolsNormalized comparison across 2–5 institutions on a named topic.
costs, admissions, outcomes, aid — each pulls a curated topic-specific field setscorecard_get_school multi-ID: output shape is rows, not profilesscorecard_get_programsList all field-of-study programs at one school with earnings and debt data.
credential_level (certificate, associate's, bachelor's) and minimum earnings thresholdscorecard_get_earningssuppressed: true flag with suppression_note, not bare nullscorecard_search_programsFind programs by CIP code or name across all institutions, ranked by median earnings.
scorecard_get_earningsInstitution-level post-graduation earnings for one school.
years parameter for time-series analysis; defaults to latest.* for current-state queriesscorecard_value_analysisWorkflow tool: "Is this school worth it?"
family_income parameter selects the applicable net price bracketdata_notes flags any suppressed or null fields with structured explanationsscorecard_lookup_cipSearch CIP codes by keyword or partial name.
scorecard_list_fieldsSearch the Scorecard field catalog by keyword.
fields parameters to search/get tools| Type | Name | Description |
|---|---|---|
| Resource | scorecard://school/{id} | Institutional profile by unit ID — injectable context for school-specific conversations |
| Resource | scorecard://programs/{id} | Program-level outcomes for a school |
| Prompt | scorecard_compare_prompt | Structures a multi-school comparison analysis using Scorecard data |
All resource data is also reachable via tools. Use scorecard_search_schools or scorecard_get_school to discover school IDs before constructing resource URIs.
Built on @cyanheads/mcp-ts-core:
none, jwt, oauthin-memory, filesystem, Supabase, Cloudflare KV/R2/D1College Scorecard-specific:
fields override for custom queriesscorecard_value_analysis workflow tool computes ROI metrics (debt-to-earnings ratio, net price to first-year earnings) that require multiple API round-trips and post-processing arithmeticAgent-friendly output:
suppressed: true flag with suppression_note — prevents hallucination of missing earnings data at selective schools with small cohortsscorecard_value_analysis — agents can verify arithmetic and branch on computed values, not raw numbersscorecard_compare_schools — structured output an agent cannot reconstruct from raw profiles without knowing the full comparison setAdd the following to your MCP client configuration file. See api.data.gov/signup for a free API key.
{
"mcpServers": {
"college-scorecard-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/college-scorecard-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info",
"SCORECARD_API_KEY": "your-api-key"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"college-scorecard-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/college-scorecard-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info",
"SCORECARD_API_KEY": "your-api-key"
}
}
}
}Or with Docker:
{
"mcpServers": {
"college-scorecard-mcp-server": {
"type": "stdio",
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "MCP_TRANSPORT_TYPE=stdio",
"-e", "SCORECARD_API_KEY=your-api-key",
"ghcr.io/cyanheads/college-scorecard-mcp-server:latest"
]
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 SCORECARD_API_KEY=... bun run start:http
# Server listens at http://localhost:3010/mcpgit clone https://github.com/cyanheads/college-scorecard-mcp-server.gitcd college-scorecard-mcp-serverbun installcp .env.example .env
# edit .env and set SCORECARD_API_KEYAll configuration is validated at startup via Zod schemas in src/config/server-config.ts. Key environment variables:
| Variable | Description | Default |
|---|---|---|
SCORECARD_API_KEY | Required. API key from api.data.gov. 1,000 req/hour rate limit. | — |
MCP_TRANSPORT_TYPE | Transport: stdio or http | stdio |
MCP_HTTP_PORT | HTTP server port | 3010 |
MCP_HTTP_ENDPOINT_PATH | HTTP endpoint path where the MCP server is mounted | /mcp |
MCP_PUBLIC_URL | Public origin override for TLS-terminating reverse-proxy deployments | none |
MCP_AUTH_MODE | Authentication: none, jwt, or oauth | none |
MCP_LOG_LEVEL | Log level (debug, info, warning, error, etc.) | info |
MCP_GC_PRESSURE_INTERVAL_MS | Opt-in forced-GC pressure loop (ms, Bun only). Try 60000 if heap growth is observed under sustained HTTP load. | 0 (disabled) |
LOGS_DIR | Directory for log files (Node.js only) | <project-root>/logs |
STORAGE_PROVIDER_TYPE | Storage backend: in-memory, filesystem, supabase, cloudflare-kv/r2/d1 | in-memory |
OTEL_ENABLED | Enable OpenTelemetry instrumentation | false |
See .env.example for the full list of optional overrides.
# One-time build
bun run rebuild
# Run the built server
bun run start:stdio
# or
bun run start:http bun run devcheck # Lint, format, typecheck, security
bun run test # Vitest test suite
bun run lint:mcp # Validate MCP definitions against specdocker build -t college-scorecard-mcp-server .
docker run --rm -e SCORECARD_API_KEY=your-key -p 3010:3010 college-scorecard-mcp-serverThe Dockerfile defaults to HTTP transport, stateless session mode, and logs to /var/log/college-scorecard-mcp-server. OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them.
| Directory | Purpose |
|---|---|
src/index.ts | createApp() entry point — registers tools/resources/prompts and inits services. |
src/config | Server-specific environment variable parsing and validation with Zod. |
src/mcp-server/tools | Tool definitions (*.tool.ts). Nine tools across search, profile, programs, earnings, and analysis. |
src/mcp-server/resources | Resource definitions. School profile and program outcomes resources. |
src/mcp-server/prompts | Prompt definitions. Multi-school comparison prompt. |
src/services | ScorecardService — fetch wrapper with retry, field selection, and pagination against the College Scorecard API. |
tests/ | Unit and integration tests mirroring src/. |
See CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for request-scoped logging, ctx.state for tenant-scoped storagesrc/mcp-server/*/definitions/index.tsIssues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.