.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/hn-mcp-server</h1> <p><b>Browse Hacker News feeds, threads, and user profiles with full-text search via MCP. STDIO or Streamable HTTP.</b> <div>4 Tools</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://hn.caseyjhand.com/mcp
</div>
Four read-only tools for accessing Hacker News data:
| Tool Name | Description |
|---|---|
hn_get_stories | Fetch stories from an HN feed (top, new, best, ask, show, jobs) with pagination. |
hn_get_thread | Get an item and its comment tree as a threaded discussion with depth/count controls. |
hn_get_user | Fetch a user profile with karma, about, and optionally their recent submissions. |
hn_search_content | Search stories and comments via Algolia with type, author, date, and score filters. |
hn_get_storiesFetch stories from any HN feed with pagination support.
top, new, best, ask, show, jobshn_get_threadRetrieve an item and its full comment tree via ranked breadth-first traversal.
depth/parentId for tree reconstructionhn_get_userFetch a user profile with optional recent submission resolution.
hn_search_contentFull-text search via the Algolia HN Search API.
story, comment, ask_hn, show_hn, front_pageBuilt on @cyanheads/mcp-ts-core:
HN-specific:
instructions orientation forwarded to LLM clients on initialize — item types, ID reuse across tools, case-sensitive usernames, and field sparsity expectationsA public instance is available at https://hn.caseyjhand.com/mcp — no installation required. Point any MCP client at it via Streamable HTTP:
{
"mcpServers": {
"hn-mcp-server": {
"type": "streamable-http",
"url": "https://hn.caseyjhand.com/mcp"
}
}
}Add to your MCP client configuration file:
{
"mcpServers": {
"hn-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/hn-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"hn-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/hn-mcp-server"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with Docker:
{
"mcpServers": {
"hn-mcp-server": {
"type": "stdio",
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "MCP_TRANSPORT_TYPE=stdio",
"ghcr.io/cyanheads/hn-mcp-server:latest"
]
}
}
}git clone https://github.com/cyanheads/hn-mcp-server.git
cd hn-mcp-server
bun installAll configuration is via environment variables. No API keys required — HN APIs are public.
| Variable | Description | Default |
|---|---|---|
HN_CONCURRENCY_LIMIT | Max concurrent HTTP requests for batch item fetches (1–50). | 10 |
MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio |
MCP_HTTP_PORT | HTTP server port. | 3010 |
MCP_HTTP_HOST | HTTP server host. | localhost |
MCP_LOG_LEVEL | Log level: debug, info, notice, warning, error. | info |
LOGS_DIR | Directory for log files (Node.js only). | <project-root>/logs |
MCP_TRANSPORT_TYPE=stdio bun --watch src/index.ts # Dev mode (stdio, auto-reload)
MCP_TRANSPORT_TYPE=http bun --watch src/index.ts # Dev mode (HTTP, auto-reload)
bun run test # Run test suite
bun run devcheck # Lint + format + typecheck + auditbun run build
bun run start:stdio # or start:httpdocker build -t hn-mcp-server .
docker run -p 3010:3010 hn-mcp-server| Directory | Purpose |
|---|---|
src/index.ts | createApp() entry point. |
src/config/ | Server-specific env var parsing with Zod. |
src/services/hn/ | HN Firebase + Algolia API client and domain types. |
src/mcp-server/tools/definitions/ | Tool definitions (*.tool.ts). |
See CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for request-scoped loggingIssues and pull requests are welcome. Run checks before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.