.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/national-parks-mcp-server</h1> <p><b>Plan US National Park Service trips — find parks, check alerts and closures, find campgrounds, browse things to do and events via the NPS Data API. STDIO or Streamable HTTP.</b> <div>6 Tools</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://national-parks.caseyjhand.com/mcp
</div>
Six tools shaped around the trip-planning workflow — resolve a park, then key the detail tools on its code:
| Tool | Description |
|---|---|
nps_find_parks | Resolve a place name, US state, or free-text query to parks — the required first step. Returns each park's parkCode plus a trip-planning summary. |
nps_get_park | Full detail for up to ten parks in one batched call: description, activities, fees & passes, hours, contacts, directions, weather overview, images. |
nps_get_alerts | Current alerts for a park or state — closures, hazards, caution, information — with category and recency surfaced first. |
nps_find_campgrounds | Campgrounds at a park or state: amenities, reservable vs. first-come site counts, reservation info, accessibility, and fees. |
nps_get_activities | Curated things to do and points of interest: title, duration, location, accessibility, and fee/pet/reservation flags. |
nps_find_events | Scheduled events within a date range: dates/times, location, category, fee, and registration links. |
Coverage is US National Park Service sites only — national parks, monuments, historic sites, seashores — not state parks and not Forest Service or BLM land.
parkCode spineparkCode (e.g. yose, grca, zion) is the join key for the whole API. The workflow is two steps:
parkCode(s) plus a summary.parkCode.nps_get_alerts, nps_find_campgrounds, and nps_find_events also accept a stateCode for statewide queries without a code (e.g. "is anything closed in Montana's parks?"). The coordinates returned by nps_find_parks / nps_get_park feed weather servers (nws-weather, open-meteo) for a forecast.
nps_find_parksResolve a place name, US state, or free-text query into NPS parks — the entry point.
"yosemite", "civil war", "redwood")stateCode or a comma-separated list (e.g. "CA", "WY,MT,ID")activity filter — case-insensitive substring match applied locally over the returned page (narrows what was fetched; does not search all ~470 sites)limit (1–50, default 10) and start offsetparkCode, designation, states, description, coordinates, headline activities, lowest entrance fee, and the NPS pagetotalCount, applied-filter echo, and broadening guidance when nothing matchednps_get_parkFull trip-planning detail for one or more parks by parkCode.
fields selector (activities, topics, fees, hours, contacts, directions, images) trims the payload to the sections you needmissingCodes enrichment with a correction hint; only a fully-empty result is an errornps_get_alertsCurrent alerts for a park or a whole state, with category and recency leading.
parkCode, stateCode, or free-text query; optional category (Danger, Caution, Information, Park Closure)format() orders Danger / Park Closure ahead of the restcategoryBreakdown enrichment counts returned alerts per category so severity is legible without scanning each onelastIndexedDate is the recency signal — a stale date may mean the condition has changednps_find_campgroundsCampgrounds at a park or across a state, flattened to what a camper filters on.
parkCode, stateCode, or free-text query; limit (1–50, default 15) and start paginationnps_get_activitiesCurated things to do and points of interest, backed by the NPS /thingstodo list (distinct from a park's raw activity tags).
parkCode or a single two-letter stateCode — at least one is requiredquery; limit (1–50, default 15) and start paginationnps_find_eventsScheduled events at a park within a date range — ranger programs, festivals, tours, interpretive events.
parkCode, stateCode, or free-text query; bound the window with dateStart / dateEnd (YYYY-MM-DD)pageNumber / pageSize), not offset — the /events endpoint differs from the rest of the APIerrors[] array folds into the result notice as a warning rather than failing the requestBuilt on @cyanheads/mcp-ts-core:
none, jwt, oauthin-memory, filesystem, Supabase, Cloudflare KV/R2/D1NPS-specific:
developer.nps.gov/api/v1, X-Api-Key auth) across six trip-planning endpointscampsites.totalSites), array-typed amenity fields, and the distinct /events envelope with lowercased field names — coerced to clean domain types before they reach handlersnps_get_park batches up to ten park codes into a single upstream requestNPS_API_KEYAgent-friendly output:
totalCount, truncation (shown / cap), applied-filter echo, and empty-result notices reach both the structured and text surfacesparkCode-first workflow is encoded in every tool description; nps_get_park returns missingCodes so a wrong code self-correctsnull, not a guess; coordinates are never invented for downstream weather lookupsA public instance is available at https://national-parks.caseyjhand.com/mcp — no installation required. Point any MCP client at it via Streamable HTTP, with this client config:
{
"mcpServers": {
"national-parks-mcp-server": {
"type": "streamable-http",
"url": "https://national-parks.caseyjhand.com/mcp"
}
}
}Add the following to your MCP client configuration file. A free NPS Data API key is required — instant signup here.
{
"mcpServers": {
"national-parks-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/national-parks-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info",
"NPS_API_KEY": "your-api-key"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"national-parks-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/national-parks-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info",
"NPS_API_KEY": "your-api-key"
}
}
}
}Or with Docker:
{
"mcpServers": {
"national-parks-mcp-server": {
"type": "stdio",
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "MCP_TRANSPORT_TYPE=stdio",
"-e", "NPS_API_KEY=your-api-key",
"ghcr.io/cyanheads/national-parks-mcp-server:latest"
]
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 NPS_API_KEY=... bun run start:http
# Server listens at http://localhost:3010/mcpgit clone https://github.com/cyanheads/national-parks-mcp-server.gitcd national-parks-mcp-serverbun installcp .env.example .env
# edit .env and set NPS_API_KEYAll configuration is validated at startup via Zod schemas. Key environment variables:
| Variable | Description | Default |
|---|---|---|
NPS_API_KEY | Required. NPS Data API key, sent as the X-Api-Key header. The server fails to start without it. | — |
NPS_BASE_URL | NPS Data API base URL override (testing / proxy). | https://developer.nps.gov/api/v1 |
MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio |
MCP_HTTP_PORT | Port for the HTTP server. | 3010 |
MCP_HTTP_ENDPOINT_PATH | Path where the MCP server is mounted. | /mcp |
MCP_AUTH_MODE | Auth mode: none, jwt, or oauth. | none |
MCP_LOG_LEVEL | Log level (RFC 5424). | info |
LOGS_DIR | Directory for log files (Node.js only). | <project-root>/logs |
STORAGE_PROVIDER_TYPE | Storage backend: in-memory, filesystem, supabase, cloudflare-kv/r2/d1. | in-memory |
OTEL_ENABLED | Enable OpenTelemetry instrumentation. | false |
See .env.example for the full list of optional overrides.
# One-time build
bun run rebuild
# Run the built server
bun run start:stdio
# or
bun run start:http bun run devcheck # Lint, format, typecheck, security
bun run test # Vitest test suite
bun run lint:mcp # Validate MCP definitions against specdocker build -t national-parks-mcp-server .
docker run --rm -e NPS_API_KEY=your-key -p 3010:3010 national-parks-mcp-serverThe Dockerfile defaults to HTTP transport, stateless session mode, and logs to /var/log/national-parks-mcp-server. OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them.
| Directory | Purpose |
|---|---|
src/index.ts | createApp() entry point — registers the six tools and inits the NPS service. |
src/config | Server-specific environment variable parsing and validation with Zod. |
src/mcp-server/tools | Tool definitions (*.tool.ts). |
src/services/nps | NPS Data API service — HTTP client, retry boundary, error-envelope detection, and all upstream normalization. |
tests/ | Unit and integration tests mirroring src/. |
See AGENTS.md / CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for request-scoped logging, ctx.state for tenant-scoped storagecreateApp() arraysIssues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
Data is retrieved from the NPS Data API operated by the U.S. National Park Service. Content produced by NPS employees in their official capacity is a U.S. Government work in the public domain (17 U.S.C. §§ 101 and 105). No claim to original U.S. Government works.
Not all content returned by the API is government-authored. Some images and materials carry third-party copyright or other restrictions — check individual item rights before reuse.
The NPS Arrowhead symbol is a restricted mark protected under 18 U.S.C. § 701. It must not be reproduced or reused without written permission from the NPS Director.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.