national-parks-mcp-server-216ddf — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited national-parks-mcp-server-216ddf (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/national-parks-mcp-server</h1> <p><b>Plan US National Park Service trips — find parks, check alerts and closures, find campgrounds, browse things to do and events via the NPS Data API. STDIO or Streamable HTTP.</b> <div>6 Tools • 1 Skill</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://national-parks.caseyjhand.com/mcp
</div>
Plan a National Park Service trip: find a park, check alerts and closures, and browse campgrounds, activities, and events. Covers national parks, monuments, historic sites, and seashores, not state parks, Forest Service, or BLM land.
| Tool | Description |
|---|---|
nps_find_parks | Resolve a place name, US state, or free-text query to parks — the required first step. Returns each park's parkCode plus a trip-planning summary. |
nps_get_park | Full detail for up to ten parks in one batched call: description, activities, fees & passes, hours, contacts, directions, weather overview, images. |
nps_get_alerts | Current alerts for a park or state — closures, hazards, caution, information — with category and recency surfaced first. |
nps_find_campgrounds | Campgrounds at a park or state: amenities, reservable vs. first-come site counts, reservation info, accessibility, and fees. |
nps_get_activities | Curated things to do and points of interest: title, duration, location, accessibility, and fee/pet/reservation flags. |
nps_find_events | Scheduled events within a date range: dates/times, location, category, fee, and registration links. |
nps_find_parks <sub>tool</sub>query, two-letter stateCode (or a comma-separated list such as "WY,MT,ID"), and an optional activity filter; limit 1–50 (default 10) with a start offsetparkCode plus designation, states, description, coordinates, headline activities, lowest entrance fee, and NPS page; exact parkCode or name matches rank first, and totalCount counts every matchnps_get_park <sub>tool</sub>parkCodes per call; the optional fields selector (activities, topics, fees, hours, contacts, directions, images) trims the payload to the sections you needimagesTruncated when the park has more)missingCodes; the call fails (no_parks_found) only when none resolvenps_get_alerts <sub>tool</sub>parkCode, stateCode, free-text query, and category (Danger, Caution, Information, Park Closure); limit 1–50 (default 20) with a start offsetlastIndexedDate recency, and detail; categoryBreakdown counts the returned alerts by severitynps_find_campgrounds <sub>tool</sub>parkCode, stateCode, or free-text query; limit 1–50 (default 15) with a start offsetnps_get_activities <sub>tool</sub>parkCode or a single stateCode is required, plus an optional query; limit 1–50 (default 15) with a start offsetnps_find_events <sub>tool</sub>parkCode, stateCode, or query within a dateStart / dateEnd window (YYYY-MM-DD); pages by pageNumber and pageSize (1–50, default 15), not by offsetoccurrenceDates inside the window (isRecurring marks a series), time slots, location, category, fee, and registration and info URLsBuilt on @cyanheads/mcp-ts-core: stdio and Streamable HTTP transports, pluggable auth (none / jwt / oauth), swappable storage (in-memory, filesystem, Supabase, Cloudflare KV/R2/D1), structured logging with optional OpenTelemetry tracing.
NPS-specific:
developer.nps.gov/api/v1, X-Api-Key auth) across six trip-planning endpointscampsites.totalSites), array-typed amenity fields, and the distinct /events envelope with lowercased field names — coerced to clean domain types before they reach handlersnps_get_park batches up to ten park codes into a single upstream requestNPS_API_KEYnps_find_parks / nps_get_park feed weather servers (nws-weather, open-meteo) for a forecastAgent-friendly output:
national-parks-guide skill checks park identity, access, reservation evidence, and event dates. It ships with plugins, npm, Docker, and MCPB, and MCP clients discover it through the Skills extension (skill://national-parks-guide/SKILL.md).totalCount, truncation (truncated / shown / cap), applied-filter echo, and empty-result notices reach both the structured and text surfacesparkCode-first workflow is encoded in every tool description; nps_get_park returns missingCodes so a wrong code self-correctsnull, not a guess; coordinates are never invented for downstream weather lookupsConnect to the hosted instance, no install:
claude mcp add --transport http national-parks-mcp-server https://national-parks.caseyjhand.com/mcpOr run it locally:
claude mcp add national-parks-mcp-server -e NPS_API_KEY=your-key -- npx -y @cyanheads/national-parks-mcp-serverFor other clients, add this to the MCP config file:
{
"mcpServers": {
"national-parks-mcp-server": {
"command": "npx",
"args": ["-y", "@cyanheads/national-parks-mcp-server"],
"env": {
"NPS_API_KEY": "your-api-key"
}
}
}
}Get a free NPS Data API key. For Docker or a source build, see Running the server.
All configuration is validated at startup via Zod schemas. Key environment variables:
| Variable | Description | Default |
|---|---|---|
NPS_API_KEY | Required. NPS Data API key, sent as the X-Api-Key header. The server fails to start without it. | — |
NPS_BASE_URL | NPS Data API base URL override (testing / proxy). | https://developer.nps.gov/api/v1 |
MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio |
MCP_HTTP_PORT | Port for the HTTP server. | 3010 |
MCP_HTTP_ENDPOINT_PATH | Path where the MCP server is mounted. | /mcp |
MCP_SESSION_MODE | Session handling: auto, stateful, or stateless. The schema default auto resolves to stateful; this server sets stateless explicitly. MCP 2026-07-28 is sessionless in either mode. | stateless |
MCP_AUTH_MODE | Auth mode: none, jwt, or oauth. | none |
MCP_LOG_LEVEL | Log level (RFC 5424). | info |
LOGS_DIR | Directory for log files (Node.js only). | <project-root>/logs |
LOG_TOOL_FAILURE_PAYLOADS | Log each failed tool call's arguments and result, redacted by key name and capped at LOG_TOOL_FAILURE_PAYLOAD_MAX_BYTES (default 16384). A secret inside a free-form value is not redacted. | false |
STORAGE_PROVIDER_TYPE | Storage backend: in-memory, filesystem, supabase, cloudflare-kv/r2/d1. | in-memory |
OTEL_ENABLED | Enable OpenTelemetry instrumentation (spans, metrics, completion logs). | false |
See .env.example for the full list of optional overrides.
Requires Bun v1.4 or higher (or Node.js v24+) and an NPS Data API key.
git clone https://github.com/cyanheads/national-parks-mcp-server.git
cd national-parks-mcp-server && bun install
cp .env.example .env # set NPS_API_KEY # One-time build
bun run rebuild
# Run the built server
bun run start:stdio
# or
bun run start:http bun run devcheck # Lint, format, typecheck, security
bun run test # Vitest test suite
bun run lint:mcp # Validate MCP definitions against specdocker run --rm -e NPS_API_KEY=your-key -p 3010:3010 ghcr.io/cyanheads/national-parks-mcp-server:latestThe image defaults to HTTP transport, stateless session mode, and logs to /var/log/national-parks-mcp-server. To run over stdio, use docker run -i --rm -e MCP_TRANSPORT_TYPE=stdio -e NPS_API_KEY=your-key ghcr.io/cyanheads/national-parks-mcp-server:latest. Build locally with docker build -t national-parks-mcp-server .; OpenTelemetry peers are installed by default — add --build-arg OTEL_ENABLED=false to omit them.
| Directory | Purpose |
|---|---|
src/index.ts | createApp() entry point — registers the six tools and inits the NPS service. |
src/config | Server-specific environment variable parsing and validation with Zod. |
src/mcp-server/tools | Tool definitions (*.tool.ts). |
src/services/nps | NPS Data API service — HTTP client, retry boundary, error-envelope detection, and all upstream normalization. |
skills/ | Published visit-planning guidance for agents using the tools, also served over MCP. |
framework-skills/ | Development guidance synced from the framework. |
tests/ | Unit and integration tests mirroring src/. |
See AGENTS.md / CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for request-scoped logging, ctx.state for tenant-scoped storagecreateApp() arraysData is retrieved from the NPS Data API operated by the U.S. National Park Service. Content produced by NPS employees in their official capacity is a U.S. Government work in the public domain (17 U.S.C. §§ 101 and 105). No claim to original U.S. Government works.
Not all content returned by the API is government-authored. Some images and materials carry third-party copyright or other restrictions — check individual item rights before reuse.
The NPS Arrowhead symbol is a restricted mark protected under 18 U.S.C. § 701. It must not be reproduced or reused without written permission from the NPS Director.
Issues are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.