.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/earthquake-mcp-server</h1> <p><b>Search USGS and EMSC seismic data — real-time feeds, event queries, and earthquake counts via MCP. STDIO or Streamable HTTP.</b> <div>4 Tools • 2 Resources</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://earthquake.caseyjhand.com/mcp
</div>
4 tools for querying global earthquake data from USGS and EMSC:
| Tool | Description |
|---|---|
earthquake_get_feed | Fetch a USGS pre-computed real-time earthquake feed by magnitude tier and time window |
earthquake_search | Search earthquakes by time range, magnitude, depth, location radius, PAGER alert level, or felt reports |
earthquake_count | Count earthquakes matching filters without fetching full records |
earthquake_get_event | Fetch complete detail for a specific earthquake by USGS event ID |
earthquake_get_feedFetch a USGS pre-computed real-time earthquake feed by magnitude tier and time window.
all (microseisms), 1.0, 2.5, 4.5, and significant (USGS-curated by magnitude, felt reports, and PAGER impact)hour, day, week, monthearthquake_search for historical or filtered queriesearthquake_searchSearch earthquakes by time range, magnitude, depth, location radius, PAGER alert level, or felt reports.
green/yellow/orange/red), DYFI felt reports count, significance scorelatitude, longitude, and radius_km togetherearthquake_count first to gauge result sizesource=emscearthquake_countCount earthquakes matching filters without fetching full records.
earthquake_search for statistical queries ("how many M5+ events in 2025?")earthquake_search: time, magnitude, depth, location radius, PAGER, DYFI, significanceexceeds_limit flag when count exceeds 20,000 — signals that a full search would be truncatedmax_allowed cap (20,000); EMSC count endpoint does not expose this field (max_allowed will be null)earthquake_get_eventFetch complete detail for a specific earthquake by USGS event ID.
id field of earthquake_get_feed and earthquake_search results (e.g. us6000sznj, hv74966427)| Type | URI pattern | Description |
|---|---|---|
| Resource | earthquake://feed/{magnitude_tier}/{time_window} | USGS real-time earthquake feed as injectable context |
| Resource | earthquake://event/{event_id} | Full USGS earthquake event detail by ID as injectable context |
Built on @cyanheads/mcp-ts-core:
none, jwt, oauth)in-memory, filesystem, Supabase, Cloudflare KV/R2/D1Earthquake-specific:
Agent-friendly output:
usgs / emsc) so agents can reason about data provenanceexceeds_limit flag on count responses surfaces truncation risk before a full searchalert_level, felt, mmi, tsunami) clearly labeled as USGS-only to prevent misattribution on EMSC resultsA public instance is available at https://earthquake.caseyjhand.com/mcp — no installation required. Point any MCP client at it via Streamable HTTP:
{
"mcpServers": {
"earthquake-mcp-server": {
"type": "streamable-http",
"url": "https://earthquake.caseyjhand.com/mcp"
}
}
}Add the following to your MCP client configuration file.
{
"mcpServers": {
"earthquake-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/earthquake-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"earthquake-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/earthquake-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with Docker:
{
"mcpServers": {
"earthquake-mcp-server": {
"type": "stdio",
"command": "docker",
"args": ["run", "-i", "--rm", "-e", "MCP_TRANSPORT_TYPE=stdio", "ghcr.io/cyanheads/earthquake-mcp-server:latest"]
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http
# Server listens at http://localhost:3010/mcpgit clone https://github.com/cyanheads/earthquake-mcp-server.gitcd earthquake-mcp-serverbun installAll configuration is validated at startup via Zod schemas in src/config/server-config.ts. Key environment variables:
| Variable | Description | Default |
|---|---|---|
MCP_TRANSPORT_TYPE | Transport: stdio or http | stdio |
MCP_HTTP_PORT | HTTP server port | 3010 |
MCP_HTTP_ENDPOINT_PATH | HTTP endpoint path where the MCP server is mounted | /mcp |
MCP_PUBLIC_URL | Public origin override for TLS-terminating reverse-proxy deployments | none |
MCP_AUTH_MODE | Authentication: none, jwt, or oauth | none |
MCP_LOG_LEVEL | Log level (debug, info, warning, error, etc.) | info |
MCP_GC_PRESSURE_INTERVAL_MS | Opt-in Bun-only forced-GC pressure loop (ms). Try 60000 if heap growth is observed under sustained HTTP load. | 0 (disabled) |
LOGS_DIR | Directory for log files (Node.js only) | <project-root>/logs |
STORAGE_PROVIDER_TYPE | Storage backend: in-memory, filesystem, supabase, cloudflare-kv/r2/d1 | in-memory |
USGS_BASE_URL | USGS API base URL. Override for testing or mirroring. | https://earthquake.usgs.gov |
EMSC_BASE_URL | EMSC API base URL. Override for testing or mirroring. | https://www.seismicportal.eu |
DEFAULT_LIMIT | Default result limit for earthquake_search | 100 |
REQUEST_TIMEOUT_MS | HTTP timeout in milliseconds for upstream API calls | 10000 |
OTEL_ENABLED | Enable OpenTelemetry | false |
# One-time build
bun run rebuild
# Run the built server
bun run start:http
# or
bun run start:stdio bun run devcheck # Lints, formats, type-checks, and more
bun run test # Runs the test suite| Directory | Purpose |
|---|---|
src/mcp-server/tools | Tool definitions (*.tool.ts). Four tools across USGS and EMSC. |
src/mcp-server/resources | Resource definitions. Feed and event resources. |
src/services/usgs | USGS ComCat service — GeoJSON feed fetcher and FDSN query API client. |
src/services/emsc | EMSC SeismicPortal service — FDSN event search and count endpoints. |
src/config | Server-specific environment variable parsing and validation with Zod. |
tests/ | Unit and integration tests, mirroring the src/ structure. |
See CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for logging, ctx.state for storagecreateApp() arraysIssues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testThis project is licensed under the Apache 2.0 License. See the LICENSE file for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.