.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/noaa-marine-mcp-server</h1> <p><b>Find NOAA tide stations and NDBC buoys, fetch tide predictions, water levels, tidal currents, and live buoy conditions via MCP. STDIO or Streamable HTTP.</b> <div>5 Tools • 1 Resource</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://noaa-marine.caseyjhand.com/mcp
</div>
Five tools covering the full US marine operational workflow — station discovery, tide predictions, observed water levels, tidal current predictions, and live offshore buoy conditions:
| Tool | Description |
|---|---|
noaa_marine_find_stations | Find CO-OPS tide/water-level/current stations and NDBC buoys near a location or by name/state. Required first step to resolve place names or coordinates to station IDs. |
noaa_marine_get_tide_predictions | High/low tide predictions for a CO-OPS tide station over a date range. Supports 6-minute interval output and multiple datums (defaults to MLLW — US nautical chart standard). |
noaa_marine_get_water_level | Observed water level (real-time or historical) for a CO-OPS station, paired with predictions to compute storm surge or anomalous drawdown. |
noaa_marine_get_currents | Tidal current predictions for a CO-OPS current station: max flood/ebb speeds, slack times, and directions. Defaults to MAX_SLACK (practical passage-planning view). |
noaa_marine_get_conditions | Live marine conditions from an NDBC buoy: wave height/period/direction, wind, sea-surface temp, air temp, and barometric pressure. |
noaa_marine_find_stationsUnified station discovery across CO-OPS (3,450+ tide/water-level stations, 4,430+ current stations) and NDBC (1,354+ active buoys worldwide).
noaa_marine_get_tide_predictionsCO-OPS MLLW tide predictions for planning tidal windows.
date_range_exceeded for longer ranges)noaa_marine_get_water_levelObserved water level vs. predicted — the storm surge view.
noaa_marine_get_currentsCO-OPS tidal current predictions for passage planning.
ACT4176), distinct from numeric tide station IDs — use find_stations with types: ["current"] to discover themnoaa_marine_get_conditionsLive NDBC buoy observations (most recent ~45 days, updated every 10 minutes).
null when buoy sensor did not report — normal for offshore buoys)TIDE (feet) and VIS (nautical miles), which are rarely populated at offshore buoys| Type | Name | Description |
|---|---|---|
| Resource | noaa-marine://station/{station_id} | Metadata for a CO-OPS or NDBC station by ID: name, coordinates, source, capabilities, and state. |
All resource data is also reachable via tools. Use noaa_marine_find_stations to discover station IDs before accessing the resource.
Built on @cyanheads/mcp-ts-core:
none, jwt, oauthNOAA-specific:
find_stations fans out across both sources in parallelMM (missing sensor data) normalized to null, not passed through as stringsapplication= courtesy parameter sent on every request (configurable via NOAA_APPLICATION_ID)Agent-friendly output:
total_found on find_stations shows count before limit slice so agents know whether to re-querycoops | ndbc) and type fields on every station record — agents can branch on data, not string parsingNo API key required. Both NOAA CO-OPS and NDBC are open, keyless data sources.
Connect directly via Streamable HTTP — no install, no API key:
{
"mcpServers": {
"noaa-marine": {
"type": "streamable-http",
"url": "https://noaa-marine.caseyjhand.com/mcp"
}
}
}Add the following to your MCP client configuration file:
{
"mcpServers": {
"noaa-marine": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/noaa-marine-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"noaa-marine": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/noaa-marine-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with Docker:
{
"mcpServers": {
"noaa-marine": {
"type": "stdio",
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "MCP_TRANSPORT_TYPE=stdio",
"ghcr.io/cyanheads/noaa-marine-mcp-server:latest"
]
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http
# Server listens at http://localhost:3010/mcpgit clone https://github.com/cyanheads/noaa-marine-mcp-server.gitcd noaa-marine-mcp-serverbun installcp .env.example .env
# edit .env if needed (all vars optional)| Variable | Description | Default |
|---|---|---|
NOAA_APPLICATION_ID | Courtesy identifier sent as application= on CO-OPS requests. | noaa-marine-mcp-server |
MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio |
MCP_HTTP_PORT | Port for HTTP server. | 3010 |
MCP_AUTH_MODE | Auth mode: none, jwt, or oauth. | none |
MCP_LOG_LEVEL | Log level (RFC 5424). | info |
LOGS_DIR | Directory for log files (Node.js only). | <project-root>/logs |
OTEL_ENABLED | Enable OpenTelemetry instrumentation. | false |
See .env.example for the full list of optional overrides.
bun run rebuild
bun run start:stdio
# or
bun run start:http bun run devcheck # Lint, format, typecheck, security
bun run test # Vitest test suite
bun run lint:mcp # Validate MCP definitions against specdocker build -t noaa-marine-mcp-server .
docker run --rm -p 3010:3010 noaa-marine-mcp-serverThe Dockerfile defaults to HTTP transport, stateless session mode, and logs to /var/log/noaa-marine-mcp-server. OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them.
| Path | Purpose |
|---|---|
src/index.ts | createApp() entry point — registers tools, resource, and initializes services. |
src/config/ | NOAA_APPLICATION_ID env var parsing with Zod. |
src/services/coops/ | CO-OPS Tides & Currents API client: station list cache, data fetch, error detection. |
src/services/ndbc/ | NDBC buoy service: active stations XML parser, realtime text parser. |
src/mcp-server/tools/ | Five tool definitions (*.tool.ts). |
src/mcp-server/resources/ | Station metadata resource (noaa-marine-station.resource.ts). |
tests/ | Vitest tests mirroring src/. |
docs/ | Design doc and directory tree. |
See CLAUDE.md/AGENTS.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for request-scoped loggingsrc/index.ts directly (no barrels for this server)MM values must normalize to null, not be passed through as stringsIssues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.