.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/imf-mcp-server</h1> <p><b>Query IMF SDMX 3.0 macroeconomic data — 193 dataflows, 190 countries, WEO projections, BOP, CPI, exchange rates, and national accounts via MCP. STDIO or Streamable HTTP.</b> <div>5 Tools • 1 Resource</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://imf.caseyjhand.com/mcp
</div>
Five tools covering the full IMF SDMX 3.0 query workflow, plus a DuckDB-backed canvas layer for SQL analytics over large multi-country result sets:
| Tool | Description |
|---|---|
imf_list_databases | List all IMF SDMX dataflows available on the portal (193 total), with optional name/ID substring filtering |
imf_get_database | Fetch a dataflow's dimension list and complete codelist — resolves human terms to SDMX codes before querying |
imf_query_dataset | Query a dataflow by dimension key over a time range; large result sets spill to DataCanvas |
imf_dataframe_describe | List DataCanvas tables and columns staged by a prior imf_query_dataset call |
imf_dataframe_query | Run a read-only SQL SELECT across staged DataCanvas tables for multi-country comparisons and aggregations |
imf_list_databasesEntry point for every IMF query workflow — browse and filter the full dataflow catalog.
include_vintages=true to include themimf_get_databaseResolve human-readable terms to SDMX dimension codes before querying.
"United States" → USA, "real GDP growth" → NGDP_RPCH)key_format field shows the exact dot-separated dimension order required by imf_query_datasetcodelist_filter to search large codelists by substring (returns all matches, uncapped), or the imf://database/{dataflow_id} resource for the full listimf_query_datasetQuery an IMF SDMX dataflow by dimension key over a time range.
USA.NGDP_RPCH.A for WEO annual real GDP growth)+ syntax for multi-code positions (e.g. USA+GBR+DEU.NGDP_RPCH.A)time_period, value, status, and series attributes (unit, scale, decimals)canvas_id and table_name are returned for SQL follow-upno_data errors include availability context from the upstream constraint endpoint: series_count=0 means the code has no coverage in the dataflow; series_count>0 means the combination is wrong and available_codes lists what does have dataimf_dataframe_describe / imf_dataframe_queryIn-conversation SQL analytics over the observation tables that imf_query_dataset stages on a DuckDB-backed canvas.
When imf_query_dataset returns truncated: true, the full dataset is registered as a named table on the canvas. The workflow:
imf_query_dataset — if truncated: true, note the canvas_id and table_nameimf_dataframe_describe with the canvas_id to discover table schemaimf_dataframe_query with a SELECT statement for aggregations, cross-country comparisons, or time-series analysisOnly SELECT statements are accepted — DML and DDL are rejected. Requires CANVAS_PROVIDER_TYPE=duckdb.
| Type | URI | Description |
|---|---|---|
| Resource | imf://database/{dataflow_id} | Full metadata for a single IMF SDMX dataflow — all dimensions with complete codelists, key_format, name, and description. Stable URI-addressable reference for known dataflow IDs (WEO, BOP, CPI, etc.). |
All resource data is also reachable via imf_get_database. The resource URI provides the untruncated codelist for large dimensions that imf_get_database caps at 50 entries. The codelist_filter parameter on imf_get_database is a lighter alternative for targeted code lookup — it returns all substring matches without the cap.
Data is sourced from the International Monetary Fund SDMX 3.0 portal under the IMF Copyright and Terms of Use. The IMF's terms permit redistribution of statistical data with attribution. Each data-returning tool response includes a source field with the required attribution: Source: International Monetary Fund, <dataflow name>, https://data.imf.org/.
Built on @cyanheads/mcp-ts-core:
none, jwt, oauthin-memory, filesystem, Supabase, Cloudflare KV/R2/D1IMF SDMX-specific:
Agent-friendly output:
key_format field in every dataflow response explicitly states the dimension order, removing guesswork for key constructionstatus flags (e.g. E for estimate) so agents can communicate data quality caveatstruncated, canvas_id, and table_name are always present in the output schema, letting callers branch on data rather than heuristicsA public instance is available at https://imf.caseyjhand.com/mcp — no installation required. Point any MCP client at it via Streamable HTTP:
{
"mcpServers": {
"imf-mcp-server": {
"type": "streamable-http",
"url": "https://imf.caseyjhand.com/mcp"
}
}
}No API key required. Add the following to your MCP client configuration file.
{
"mcpServers": {
"imf-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/imf-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"imf-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/imf-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with Docker:
{
"mcpServers": {
"imf-mcp-server": {
"type": "stdio",
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "MCP_TRANSPORT_TYPE=stdio",
"ghcr.io/cyanheads/imf-mcp-server:latest"
]
}
}
}To enable SQL analytics over large result sets, add CANVAS_PROVIDER_TYPE=duckdb to the env block.
For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http
# Server listens at http://localhost:3010/mcpgit clone https://github.com/cyanheads/imf-mcp-server.gitcd imf-mcp-serverbun installcp .env.example .env
# edit .env as needed — no required vars for basic use| Variable | Description | Default |
|---|---|---|
CANVAS_PROVIDER_TYPE | Set to duckdb to enable DataCanvas spill for large result sets. | — |
IMF_BASE_URL | IMF SDMX 3.0 base URL. Override for testing or proxied environments. | https://api.imf.org/external/sdmx/3.0 |
IMF_REQUEST_TIMEOUT_MS | Per-request timeout in milliseconds. | 30000 |
MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio |
MCP_HTTP_PORT | Port for HTTP server. | 3010 |
MCP_AUTH_MODE | Auth mode: none, jwt, or oauth. | none |
MCP_LOG_LEVEL | Log level (RFC 5424). | info |
OTEL_ENABLED | Enable OpenTelemetry instrumentation. | false |
See .env.example for the full list of optional overrides.
bun run rebuild
bun run start:stdio
# or
bun run start:http bun run devcheck # Lint, format, typecheck, security
bun run test # Vitest test suite
bun run lint:mcp # Validate MCP definitions against specdocker build -t imf-mcp-server .
docker run --rm -p 3010:3010 imf-mcp-serverThe Dockerfile defaults to HTTP transport, stateless session mode, and logs to /var/log/imf-mcp-server. OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them.
| Path | Purpose |
|---|---|
src/index.ts | createApp() entry point — registers tools/resources and inits services. |
src/config/server-config.ts | Server-specific env var parsing and validation with Zod. |
src/mcp-server/tools/definitions/ | Tool definitions (*.tool.ts). |
src/mcp-server/resources/definitions/ | Resource definitions (*.resource.ts). |
src/services/canvas/ | DataCanvas accessor — wraps the framework canvas instance. |
src/services/imf-sdmx/ | IMF SDMX 3.0 API client — dataflow catalog, DSD fetching, data queries. |
tests/ | Unit and integration tests mirroring src/. |
docs/ | Design notes and directory tree. |
See CLAUDE.md/AGENTS.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for request-scoped logging, ctx.state for tenant-scoped storagesrc/mcp-server/*/definitions/index.tsIssues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.