earthquake-mcp-server-22d18f — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited earthquake-mcp-server-22d18f (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/earthquake-mcp-server</h1> <p><b>Search USGS and EMSC seismic data — real-time feeds, event queries, and earthquake counts via MCP. STDIO or Streamable HTTP.</b> <div>4 Tools • 3 Resources</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://earthquake.caseyjhand.com/mcp
</div>
Seismic data from USGS ComCat and the EMSC SeismicPortal. Fetch real-time earthquake feeds, search and count seismic events by time, magnitude, depth, and location, and pull full analysis detail for a single event.
| Tool | Description |
|---|---|
earthquake_get_feed | Fetch a USGS pre-computed real-time earthquake feed by magnitude tier and time window |
earthquake_search_events | Search earthquakes by time range, magnitude, depth, location radius, PAGER alert level, or felt reports |
earthquake_count_events | Count earthquakes matching filters without fetching full records |
earthquake_get_event | Fetch one earthquake by USGS or EMSC event ID, with USGS analysis products and opt-in origins, magnitudes, phase arrivals, and aftershock forecast |
| Resource | Description |
|---|---|
earthquake://feed/{magnitude_tier}/{time_window} | First 100-event page of a USGS real-time feed, with an exact continuation URI |
earthquake://feed/{magnitude_tier}/{time_window}/page/{cursor} | Continue the retained feed generation using the returned next_uri |
earthquake://event/{event_id} | One earthquake by USGS or EMSC event ID as injectable context, with the same detail product projection as earthquake_get_event |
| Skill | Description |
|---|---|
earthquake-guide | Agent guide for the earthquake_* tools: identifier chains between USGS and EMSC, coverage and magnitude-scale gates, and when product and include groups answer a question. Loaded by plugin hosts from skills/ and served over MCP as skill://earthquake-guide/SKILL.md |
earthquake_get_feed <sub>tool</sub>all, 1.0, 2.5, 4.5, significant) and a window (hour, day, week, month). USGS caches these feeds; use earthquake_search_events for historical or filtered queries.all includes microseisms; significant is USGS-curated using magnitude, felt reports, and PAGER impact.limit events (default 15), fewer only on the last page. A limit above 1,000 returns 1,000 with a notice naming the requested and applied values; with EARTHQUAKE_CLAMP_LIMITS=false it is rejected instead. limit applies to the first page; later pages keep the page size in the cursor. totalCount reports the whole feed; pass nextCursor back unchanged with the same tier and window.cursor_expired means restart without a cursor; legacy cursors must also be restarted.earthquake_search_events <sub>tool</sub>usgs or emsc by time, magnitude, depth, radius, or bounding box. A radius requires latitude, longitude, and radius_km together; box edges are independently optional, support antimeridian bounds up to ±360°, and intersect a supplied circle.event_type, EMSC's event_certainty, and USGS's associated_ids (other network IDs merged into the event). ignoredFilters names unsupported filters; queryEcho reports the effective query.magnitude_type values on either source. product_type (required product, e.g. moment-tensor) and review_status (automatic or reviewed) apply only to USGS; EMSC names them in ignoredFilters. Blank values mean omitted.2026-10-10 becomes 2026-10-10T00:00:00. Explicit time and timezone suffixes are preserved; unpadded date components are padded. Offsetless times use UTC for the 30-day default. queryEcho shows the exact effective bounds.limit events upstream (default 15, set by DEFAULT_LIMIT) and returns them all, fewer only on the last page. A limit above 1,000 returns 1,000 with a notice naming the requested and applied values; with EARTHQUAKE_CLAMP_LIMITS=false it is rejected instead. queryEcho.limit reports the applied limit. Continue with the returned nextOffset (offset plus the events returned, counting from 1) and the same filters, limit, and order. Search pages read the current catalog, so upstream edits can affect later pages.invalid_range, naming both values and recovery. Equal and single bounds remain valid; time comparisons use UTC instants, including explicit offsets. Calendar-invalid values remain for upstream rejection.totalCount; an empty first page establishes zero, while an empty later page leaves the total unknown. Full pages use a count lookup, with countUnavailable on failure. Feed, search, and event calls each share one 50-second deadline across their requests and retries; for search that includes the count lookup. Cancellation remains cancellation.earthquake_count_events <sub>tool</sub>earthquake_search_events, without fetching events. Omit start_time for the last 30 days; queryEcho reports the resolved window and applied filters.exceeds_limit flags the 20,000-event single-request threshold, not a retrieval ceiling: search offset paging can retrieve larger match sets. max_allowed is 20,000 for USGS and null for EMSC; ignoredFilters names filters the source cannot apply.earthquake_get_event <sub>tool</sub>id of any feed or search result. An EMSC unid from a source=emsc search (eight digits, underscore, seven digits, e.g. 20190706_0000043) is looked up on EMSC SeismicPortal; every other ID goes to USGS (e.g. us6000sznj).detail: PAGER, ShakeMap, DYFI, moment tensor, ground-failure alerts, origin quality (including depth_type, which separates an assigned depth from a located one), and finite-fault dimensions. Groups are omitted when none of their projected fields is available; absence does not imply zero impact. associated_ids lists the other network IDs USGS holds for the event; an alias such as us70004bn0 returns the preferred event (ci38457511) with the alias listed there.detail and no associated_ids.include opts into more for USGS events:| Group | Source | Extra requests |
|---|---|---|
origins | Every origin product in the event response, preferred first | None |
magnitudes | Event-level magnitudes from the preferred phase-data product's QuakeML, with a station count where published | One, shared with arrivals |
arrivals | Every phase arrival of that document's preferred origin, joined to its pick and sorted nearest first | One, shared with magnitudes |
aftershock_forecast | The USGS Operational Aftershock Forecast: each window's probability of an aftershock at or above each magnitude, its expected-count range, and the chance of one as large as the mainshock | One |
unavailable_includes: not_published when the event has no such product (every group on an EMSC event), fetch_failed when the download failed, returned HTML, did not parse, pointed outside the configured USGS origin, or answered with a redirect. The event, detail, and other groups still return; cancellation propagates. The event request and its product downloads share one 50-second deadline.code_version when published.earthquake://feed/{magnitude_tier}/{time_window} <sub>resource</sub>earthquake_get_feed; all 20 combinations are listed as browsable resources.application/json page in the compact event projection, plus totalCount, truncated, nextCursor, and next_uri. Read next_uri verbatim until it is absent. The continuation URI is earthquake://feed/{magnitude_tier}/{time_window}/page/{cursor}.earthquake_get_feed. Cache hints are private with zero lifetime because continuation tokens belong to the requesting tenant. Upstream failures classified as ServiceUnavailable expose feed_unavailable; those classified as Timeout expose feed_timeout, each with recovery guidance and no captured upstream body. Availability failures preserve numeric HTTP status; HTTP 501 remains non-retryable and points to EMSC search. Other error classes propagate unchanged.earthquake://event/{event_id} <sub>resource</sub>event_id from a feed or search result. Returns the same event and optional detail products as earthquake_get_event; it takes no include.event_deleted, not_found, source_unavailable, and source_timeout error contract.Built on @cyanheads/mcp-ts-core: stdio and Streamable HTTP transports, pluggable auth (none / jwt / oauth), swappable storage (in-memory, filesystem, Supabase, Cloudflare KV/R2/D1), structured logging with optional OpenTelemetry tracing.
USGS/EMSC-specific:
evtype code is decoded against the published event-type/certainty nomenclature into the same vocabulary USGS publishes, so event_type carries one meaning across both sourcesalert_level, min_felt, min_significance, event_type, product_type, review_status) are named in ignoredFilters when source=emsc. On USGS, event_type="earthquake" excludes quarry blasts and other non-tectonic records.Agent-friendly output:
source: "usgs" | "emsc" on search and count responses, plus source_catalog/auth fields naming the catalog and authoritative agency, so agents can weigh two independent solutions against each otherevent_type and EMSC's event_certainty preserve published classifications, with absent fields remaining unknown; exceeds_limit, countUnavailable, and truncated flags let callers branch on data instead of parsing prosenull, never a fabricated zero (tsunami, status, and mmi are always null on EMSC events); USGS-only filters dropped for an EMSC query are named in ignoredFilters rather than silently ignoredcountUnavailable rather than failing the whole search, and a failed product download lists its include groups as fetch_failed rather than failing the event lookupA public instance is available at https://earthquake.caseyjhand.com/mcp — no installation required. Point any MCP client at it via Streamable HTTP:
{
"mcpServers": {
"earthquake-mcp-server": {
"type": "streamable-http",
"url": "https://earthquake.caseyjhand.com/mcp"
}
}
}Add the following to your MCP client configuration file.
{
"mcpServers": {
"earthquake-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/earthquake-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"earthquake-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/earthquake-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with Docker:
{
"mcpServers": {
"earthquake-mcp-server": {
"type": "stdio",
"command": "docker",
"args": ["run", "-i", "--rm", "-e", "MCP_TRANSPORT_TYPE=stdio", "ghcr.io/cyanheads/earthquake-mcp-server:latest"]
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http
# Server listens at http://localhost:3010/mcpgit clone https://github.com/cyanheads/earthquake-mcp-server.gitcd earthquake-mcp-serverbun installAll configuration is validated at startup via Zod schemas in src/config/server-config.ts. Key environment variables:
| Variable | Description | Default |
|---|---|---|
MCP_TRANSPORT_TYPE | Transport: stdio or http | stdio |
MCP_HTTP_PORT | HTTP server port | 3010 |
MCP_HTTP_ENDPOINT_PATH | HTTP endpoint path where the MCP server is mounted | /mcp |
MCP_PUBLIC_URL | Public origin override for TLS-terminating reverse-proxy deployments | none |
MCP_SESSION_MODE | HTTP sessions: stateful, stateless, or auto (resolves to stateful). Overrides the createApp() declaration; Docker and .env.example also pin stateless. | stateless (declared in src/index.ts) |
MCP_AUTH_MODE | Authentication: none, jwt, or oauth | none |
MCP_LOG_LEVEL | Log level (debug, info, warning, error, etc.) | info |
MCP_GC_PRESSURE_INTERVAL_MS | Opt-in Bun-only forced-GC pressure loop (ms). Try 60000 if heap growth is observed under sustained HTTP load. | 0 (disabled) |
LOGS_DIR | Directory for log files on Node.js and Bun | <project-root>/logs |
LOG_TOOL_FAILURE_PAYLOADS | Log failed tool arguments and results, redacted by key name. Secrets inside free-form values remain. | false |
LOG_TOOL_FAILURE_PAYLOAD_MAX_BYTES | UTF-8 byte cap per logged failure payload | 16384 |
STORAGE_PROVIDER_TYPE | Storage backend: in-memory, filesystem, supabase, cloudflare-kv/r2/d1 | in-memory |
USGS_BASE_URL | USGS API base URL. Override for testing or mirroring. Product files (phase-data QuakeML, aftershock forecast) are fetched only on this origin, so a mirror must also serve them, with content URLs rewritten to its origin; otherwise those include groups report fetch_failed. | https://earthquake.usgs.gov |
EMSC_BASE_URL | EMSC API base URL. Override for testing or mirroring. | https://www.seismicportal.eu |
DEFAULT_LIMIT | Events earthquake_search_events returns when a call omits limit (1–1,000) | 15 |
EARTHQUAKE_CLAMP_LIMITS | Clamp a search or feed limit above 1,000 to 1,000 with a notice. false advertises and enforces a schema maximum of 1,000 instead. | true |
REQUEST_TIMEOUT_MS | Per-attempt HTTP timeout in milliseconds (1,000–120,000). Feed, search, and event calls also share a 50-second total deadline across every request and retry; standalone count calls use this per-attempt value. | 10000 |
OTEL_ENABLED | Enable OpenTelemetry | false |
OTEL_EXPORTER_OTLP_ENDPOINT | Base URL for traces (/v1/traces) and metrics (/v1/metrics); signal-specific endpoint variables override it | none |
OTEL_EXPORTER_OTLP_LOGS_ENDPOINT | Opt-in OTLP log endpoint, used as-is; the base URL never enables logs | none |
Empty values and unsubstituted whole-value ${…} placeholders use the defaults. See .env.example for optional overrides.
# One-time build
bun run rebuild
# Run the built server
bun run start:http
# or
bun run start:stdio bun run devcheck # Lints, formats, type-checks, and more
bun run test # Runs the test suitedocker build -t earthquake-mcp-server .
docker run --rm -p 3010:3010 earthquake-mcp-serverThe Dockerfile defaults to HTTP transport, stateless session mode, and logs to /var/log/earthquake-mcp-server. OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them.
| Directory | Purpose |
|---|---|
src/mcp-server/tools | Tool definitions (*.tool.ts). Four tools across USGS and EMSC. |
src/mcp-server/resources | Feed, feed continuation, and event resources. |
src/services/feed-snapshots.ts | Tenant-scoped serialized feed retention with bounded payload and metadata accounting. |
src/services/usgs | USGS ComCat service — GeoJSON feed fetcher, FDSN query API client, and the event include projections (origin products, phase-data QuakeML, aftershock forecast). |
src/services/emsc | EMSC SeismicPortal service — FDSN event search, count, and by-ID lookup. |
src/config | Server-specific environment variable parsing and validation with Zod. |
tests/ | Unit and integration tests, mirroring the src/ structure. |
See CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for logging, ctx.state for storagecreateApp() arraysIssues are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testThis project is licensed under the Apache 2.0 License. See the LICENSE file for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.