.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/nws-weather-mcp-server</h1> <p><b>Get US weather forecasts, active alerts, and current observations via the National Weather Service API. STDIO or Streamable HTTP.</b> <div>7 Tools • 1 Resource</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://nws.caseyjhand.com/mcp
</div>
Seven tools for real-time US weather data:
| Tool | Description |
|---|---|
nws_get_forecast | 7-day or hourly forecast for coordinates. Resolves NWS grid internally. |
nws_search_alerts | Active weather alerts filtered by area, point, zone, event, severity, urgency, certainty, and status. |
nws_get_observations | Current conditions by coordinates (nearest station) or station ID. |
nws_find_stations | Nearby observation stations sorted by distance with bearing. |
nws_list_alert_types | All valid alert event type names for filter discovery. |
nws_get_office_discussion | Latest narrative product (AFD, HWO, ZFP, SPS) from a Weather Forecast Office. |
nws_get_zone_forecast | Text forecast periods for a public NWS forecast zone. |
nws_get_forecastGet the weather forecast for a US location.
/points endpointnws_search_alertsnws_search_alertsSearch active weather alerts with flexible filtering.
area, point, and zone are mutually exclusive; specify at most one location filter"tornado" matches both watches and warningsstatus defaults to live Actual alerts, but can be set to Exercise, System, Test, or Draftnws_get_observationsCurrent measured conditions from a weather station.
station_id values are ignored so clients can fall back to coordinates cleanlynws_find_stationsDiscover nearby observation stations.
nws_get_observationsnws_list_alert_typesList all valid NWS alert event type names.
event filter in nws_search_alertsnws_get_office_discussionGet the latest narrative product from a Weather Forecast Office (WFO).
office: 3-letter WFO code (e.g., SEW for Seattle) — returned as the office field by nws_get_forecastproduct_type: AFD (Area Forecast Discussion, default), HWO (Hazardous Weather Outlook), ZFP (Zone Forecast Product), SPS (Special Weather Statement)productText plus issuanceTime, issuingOffice, productName, productCode, wmoCollectiveIdnws_get_zone_forecastGet the text forecast for a public NWS forecast zone.
zone_id: forecast zone code (e.g., WAZ315) — returned by nws_get_forecast (forecastZone), nws_find_stations (forecastZone column), and nws_search_alerts (affectedZones)XXC###) are not supported — use the forecast zone code| URI Pattern | Description |
|---|---|
nws://alert-types | Static list of all valid NWS alert event type names. |
Built on @cyanheads/mcp-ts-core:
none, jwt, oauth)in-memory, filesystem, Supabase, Cloudflare KV/R2/D1NWS-specific:
A public instance is available at https://nws.caseyjhand.com/mcp — no installation required. Point any MCP client at it via Streamable HTTP:
{
"mcpServers": {
"nws-weather-mcp-server": {
"type": "streamable-http",
"url": "https://nws.caseyjhand.com/mcp"
}
}
}Add the following to your MCP client configuration file.
{
"mcpServers": {
"nws-weather-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/nws-weather-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"nws-weather-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/nws-weather-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with Docker:
{
"mcpServers": {
"nws-weather-mcp-server": {
"type": "stdio",
"command": "docker",
"args": ["run", "-i", "--rm", "-e", "MCP_TRANSPORT_TYPE=stdio", "ghcr.io/cyanheads/nws-weather-mcp-server:latest"]
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http
# Server listens at http://localhost:3010/mcpgit clone https://github.com/cyanheads/nws-weather-mcp-server.gitcd nws-weather-mcp-serverbun install| Variable | Description | Default |
|---|---|---|
NWS_USER_AGENT | User-Agent for NWS API requests. The API requires this header. | (nws-weather-mcp-server, ...) |
MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio |
MCP_HTTP_PORT | Port for HTTP server. | 3010 |
MCP_HTTP_HOST | Hostname for HTTP server. | 127.0.0.1 |
MCP_LOG_LEVEL | Log level: debug, info, notice, warning, error. | info |
See .env.example for the full list including auth, storage, and OpenTelemetry options.
# One-time build
bun run rebuild
# Run the built server
bun run start:http
# or
bun run start:stdio bun run devcheck # Lints, formats, type-checks
bun run test # Runs test suite| Directory | Purpose |
|---|---|
src/mcp-server/tools/definitions/ | Tool definitions (*.tool.ts). |
src/mcp-server/resources/definitions/ | Resource definitions (*.resource.ts). |
src/services/nws/ | NWS API client and response types. |
src/config/ | Environment variable parsing and validation with Zod. |
See CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for domain-specific logging, ctx.state for storagecreateApp() arrays in src/index.tsIssues and pull requests are welcome. Run checks before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.