.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/nonprofit-explorer-mcp-server</h1> <p><b>Search and explore 1.8M+ US nonprofits, fetch Form 990 financials, and access IRS filing history via MCP. STDIO or Streamable HTTP.</b> <div>3 Tools</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://nonprofit-explorer.caseyjhand.com/mcp
</div>
3 tools for working with US nonprofit and IRS Form 990 data:
| Tool | Description |
|---|---|
nonprofit_search | Search 1.8M+ IRS-recognized tax-exempt organizations by name, keyword, city, or phrase with optional state, NTEE sector, and 501(c) filters |
nonprofit_get_organization | Full profile for one org by EIN: legal identity, IRS classification, ruling date, and a financial snapshot from the most recent Form 990 |
nonprofit_get_filings | All Form 990 filings for an org by EIN: year-by-year financials, program-expense ratio, executive compensation, and source PDF/XML links |
nonprofit_searchSearch for tax-exempt organizations across the IRS Nonprofit Explorer dataset.
"Red Cross"), required terms (+evanston), excluded terms (-dental)ZZ for foreign entities)3 = public charity, 4 = social welfare)page (zero-indexed) and num_pages to walk large result setstotal_results === 10000 means the actual count may be highernonprofit_get_organization or nonprofit_get_filings for detailsnonprofit_get_organizationFetch the full profile for a single tax-exempt org by EIN.
530196605) or string with or without hyphen ("53-0196605")filing_count shows how many filings with extracted data are on recordtax_prd_yr in the snapshot is the fiscal year of the filing, not the current yearnonprofit_search first if you only have an org namenonprofit_get_filingsFetch the full filing history for an org by EIN.
filings_pdf_only lists older filings with a PDF but no extracted datatax_prd_yr (fiscal year) when presenting figuresBuilt on @cyanheads/mcp-ts-core:
none, jwt, oauthin-memory, filesystem, Supabase, Cloudflare KV/R2/D1ProPublica Nonprofit Explorer / IRS-specific:
Agent-friendly output:
data_source attribution on all tool outputs, ProPublica URL for direct verificationtax_prd_yr prominently labeled as fiscal year with explicit lag caveat in every financial responsefield_name and form_type exposed so agents know exactly which IRS field was readA public instance is available at https://nonprofit-explorer.caseyjhand.com/mcp — no installation required. Point any MCP client at it via Streamable HTTP, with this client config:
{
"mcpServers": {
"nonprofit-explorer-mcp-server": {
"type": "streamable-http",
"url": "https://nonprofit-explorer.caseyjhand.com/mcp"
}
}
}Or, install locally and add the following to your MCP client configuration file.
{
"mcpServers": {
"nonprofit-explorer-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/nonprofit-explorer-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"nonprofit-explorer-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/nonprofit-explorer-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with Docker:
{
"mcpServers": {
"nonprofit-explorer-mcp-server": {
"type": "stdio",
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "MCP_TRANSPORT_TYPE=stdio",
"ghcr.io/cyanheads/nonprofit-explorer-mcp-server:latest"
]
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http
# Server listens at http://localhost:3010/mcpgit clone https://github.com/cyanheads/nonprofit-explorer-mcp-server.gitcd nonprofit-explorer-mcp-serverbun installcp .env.example .env
# edit .env as needed (no required vars — server works out of the box)All configuration is validated at startup. Key environment variables:
| Variable | Description | Default |
|---|---|---|
MCP_TRANSPORT_TYPE | Transport: stdio or http | stdio |
MCP_HTTP_PORT | HTTP server port | 3010 |
MCP_HTTP_HOST | HTTP server hostname | 127.0.0.1 |
MCP_HTTP_ENDPOINT_PATH | HTTP endpoint path | /mcp |
MCP_PUBLIC_URL | Public origin override for TLS-terminating reverse-proxy deployments | — |
MCP_AUTH_MODE | Authentication: none, jwt, or oauth | none |
MCP_LOG_LEVEL | Log level (debug, info, warning, error, etc.) | info |
LOGS_DIR | Directory for log files (Node.js only) | <project-root>/logs |
STORAGE_PROVIDER_TYPE | Storage backend: in-memory, filesystem, supabase, cloudflare-kv/r2/d1 | in-memory |
OTEL_ENABLED | Enable OpenTelemetry instrumentation | false |
No server-specific required variables. ProPublica Nonprofit Explorer is a keyless public API.
See .env.example for the full list of optional overrides.
# One-time build
bun run rebuild
# Run the built server
bun run start:stdio
# or
bun run start:http bun run devcheck # Lint, format, typecheck, security
bun run test # Vitest test suite
bun run lint:mcp # Validate MCP definitions against specdocker build -t nonprofit-explorer-mcp-server .
docker run --rm -p 3010:3010 nonprofit-explorer-mcp-serverThe Dockerfile defaults to HTTP transport, stateless session mode, and logs to /var/log/nonprofit-explorer-mcp-server. OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them.
| Directory | Purpose |
|---|---|
src/index.ts | createApp() entry point — registers tools and inits the service. |
src/mcp-server/tools | Tool definitions (*.tool.ts). Three tools for search and financial data. |
src/services/nonprofit-explorer | ProPublica Nonprofit Explorer API client and domain types. |
tests/ | Unit and integration tests mirroring src/. |
See CLAUDE.md/AGENTS.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for request-scoped logging, ctx.state for tenant-scoped storagecreateApp() in src/index.tsIssues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.