.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/noaa-spaceweather-mcp-server</h1> <p><b>Query NOAA SWPC space weather: geomagnetic storm scales, Kp index, aurora forecasts, solar wind, solar activity, and alerts via MCP. STDIO or Streamable HTTP.</b> <div>6 Tools</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://noaa-spaceweather.caseyjhand.com/mcp
</div>
Six tools covering the full NOAA SWPC space weather surface — from a quick status heartbeat to deep solar and geomagnetic data:
| Tool | Description |
|---|---|
noaa_spaceweather_get_conditions | Current space-weather snapshot: NOAA R/S/G storm scales, latest Kp, and a plain-language status summary |
noaa_spaceweather_get_kp_index | Planetary K-index (0–9) — recent observed 3-hour values with G-scale equivalents and aurora-latitude guidance, plus 3-day forecast |
noaa_spaceweather_get_aurora_forecast | OVATION model aurora forecast: global probability grid, optional local lookup by coordinates with go/no-go verdict |
noaa_spaceweather_get_solar_wind | Real-time solar wind from DSCOVR: speed, proton density, temperature, and the critical Bz component — explains why current geomagnetic conditions exist |
noaa_spaceweather_get_solar_activity | Solar flare picture: GOES X-ray flux, 3-day flare-class probabilities, active solar regions with per-region probabilities, and solar radiation storm level |
noaa_spaceweather_get_alerts | Active SWPC alerts, watches, and warnings — structured records with product type, severity, issue time, validity window, and full message text |
noaa_spaceweather_get_conditionsThe heartbeat tool. Use it first — it composes storm scales + current Kp into a single snapshot with a plain-language summary.
noaa-scales.json + noaa-planetary-k-index.jsonnoaa_spaceweather_get_kp_indexPlanetary K-index time series for geomagnetic activity tracking.
window_days parameter (1–7, default 1) — recent 3-hour observed valuesnoaa_spaceweather_get_aurora_forecastOVATION model aurora probability at 1° resolution, updated every ~5 minutes.
latitude, longitude): nearest-grid-point lookup, minimum Kp required at that latitude, and a plain-language verdict ("Good aurora chance (42%) — Kp≥6 needed at this latitude")noaa_spaceweather_get_solar_windDSCOVR satellite real-time solar wind plasma and magnetic field.
window_hours parameter (1–168, default 3) — time series sliced client-side from 7-day feednoaa_spaceweather_get_solar_activitySolar flare and radiation storm picture from GOES and SWPC probabilities.
include_regions: true (default)noaa_spaceweather_get_alertsActive SWPC alerts, watches, and warnings from the products/alerts.json feed.
Valid From/To, Now Valid Until, or Begin/End Time)active_only: true); set false for recent historyBuilt on @cyanheads/mcp-ts-core:
none, jwt, oauthin-memory, filesystem, Supabase, Cloudflare KV/R2/D1Space weather domain:
SpaceWeatherService wraps all six NOAA SWPC JSON feeds with fetchWithTimeout + withRetryAgent-friendly output:
feed_unavailable → "Retry in 30–60 s"A public instance is available at https://noaa-spaceweather.caseyjhand.com/mcp — no installation required. Point any MCP client at it via Streamable HTTP:
{
"mcpServers": {
"noaa-spaceweather-mcp-server": {
"type": "streamable-http",
"url": "https://noaa-spaceweather.caseyjhand.com/mcp"
}
}
}Add the following to your MCP client configuration file.
{
"mcpServers": {
"noaa-spaceweather": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/noaa-spaceweather-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"noaa-spaceweather": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/noaa-spaceweather-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with Docker:
{
"mcpServers": {
"noaa-spaceweather": {
"type": "stdio",
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "MCP_TRANSPORT_TYPE=stdio",
"ghcr.io/cyanheads/noaa-spaceweather-mcp-server:latest"
]
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http
# Server listens at http://localhost:3010/mcpgit clone https://github.com/cyanheads/noaa-spaceweather-mcp-server.gitcd noaa-spaceweather-mcp-serverbun installcp .env.example .env
# edit .env if needed — all defaults work out of the box| Variable | Description | Default |
|---|---|---|
MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio |
MCP_HTTP_PORT | Port for HTTP server. | 3010 |
MCP_HTTP_HOST | Hostname for HTTP server. | 127.0.0.1 |
MCP_HTTP_ENDPOINT_PATH | Endpoint path. | /mcp |
MCP_AUTH_MODE | Auth mode: none, jwt, or oauth. | none |
MCP_LOG_LEVEL | Log level (RFC 5424). | info |
LOGS_DIR | Directory for log files (Node.js only). | <project-root>/logs |
STORAGE_PROVIDER_TYPE | Storage backend. | in-memory |
OTEL_ENABLED | Enable OpenTelemetry instrumentation. | false |
No domain-specific API keys are required. See .env.example for the full list of optional overrides.
# One-time build
bun run rebuild
# Run the built server
bun run start:stdio
# or
bun run start:http bun run devcheck # Lint, format, typecheck, security
bun run test # Vitest test suite
bun run lint:mcp # Validate MCP definitions against specdocker build -t noaa-spaceweather-mcp-server .
docker run --rm -p 3010:3010 noaa-spaceweather-mcp-serverThe Dockerfile defaults to HTTP transport, stateless session mode, and logs to /var/log/noaa-spaceweather-mcp-server. OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them.
| Path | Purpose |
|---|---|
src/index.ts | createApp() entry point — registers tools and inits the service. |
src/services/space-weather/ | SpaceWeatherService — fetches and normalizes all NOAA SWPC feeds. |
src/mcp-server/tools/definitions/ | Tool definitions (*.tool.ts) — one file per tool. |
tests/ | Unit and integration tests mirroring src/. |
docs/ | Design doc and directory tree. |
See CLAUDE.md/AGENTS.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for request-scoped logging, ctx.state for tenant-scoped storagesrc/mcp-server/tools/definitions/index.tsIssues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.