.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/oecd-mcp-server</h1> <p><b>Search, explore, and query 1,500+ OECD statistical datasets (national accounts, employment, trade, PISA, health) via SDMX via MCP. STDIO or Streamable HTTP.</b> <div>7 Tools • 1 Resource</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
Five discovery and data tools plus two SQL analytics tools for large query results:
| Tool | Description |
|---|---|
oecd_list_agencies | List OECD SDMX agencies and the number of dataflows each publishes |
oecd_search_datasets | Search 1,500+ OECD dataflows by keyword or theme |
oecd_get_dataset_info | Fetch a dataflow's dimensions, key order, and codelist references |
oecd_get_dimension_values | Fetch valid codes and labels for one dimension (countries, measures, frequencies) |
oecd_query_dataset | Fetch observations filtered by dimension key and time range; spills large results to DataCanvas |
oecd_dataframe_describe | List DataCanvas tables and columns staged by a prior oecd_query_dataset spill |
oecd_dataframe_query | Run a read-only SQL SELECT against DataCanvas tables |
oecd_list_agenciesEntry point for discovery — enumerate OECD's statistical departments before searching.
OECD.SDD.NAD, OECD.ELS, OECD.EDU) and dataflow countsoecd_search_datasets by department (national accounts, labour, education, etc.)oecd_search_datasetsSearch the full catalog of 1,500+ OECD dataflows by keyword or department.
agency_id filter scopes results to a specific statistical departmentflow_ref values (e.g. OECD.SDD.NAD,DSD_NAAG@DF_NAAG_I) — pass directly to oecd_get_dataset_info or oecd_query_datasetoecd_get_dataset_infoInspect a dataflow's structure before querying.
oecd_query_datasetoecd_get_dimension_values to resolve human-readable names to SDMX codesNonProductionDataflow flag — marks experimental or deprecated dataflowsoecd_query_dataset on an unfamiliar dataflowoecd_get_dimension_valuesResolve human-readable names (countries, measures) to SDMX codes.
REF_AREA → USA/United States, DEU/Germany)REF_AREA codelist has 570+ entries and is returned in fulloecd_query_datasetFetch observations from an OECD dataflow filtered by dimension key and time range.
A.USA+DEU.B1GQ_R.PC.) where empty segments are wildcards and + separates multiple valuesstart_period / end_period bound the time range (ISO format: 2010, 2010-Q1)0:0:2:3:0) into human-readable row objects with dimension labelssource: "OECD" per OECD terms of usecanvas_id + truncated: true — use oecd_dataframe_describe to list tables, then oecd_dataframe_query for SQL analyticsoecd_dataframe_describe / oecd_dataframe_querySQL analytics over observation data staged by oecd_query_dataset.
When oecd_query_dataset returns truncated: true, the full result is staged on a DuckDB-backed DataCanvas. Pass the canvas_id to:
Requires CANVAS_PROVIDER_TYPE=duckdb. Read-only: writes, DDL, and system catalog access are rejected.
Typical workflow for a large query:
oecd_query_dataset → { canvas_id, truncated: true, rows: [preview...] }
→ oecd_dataframe_describe(canvas_id) → table/column names
→ oecd_dataframe_query(canvas_id, "SELECT ref_area, AVG(obs_value) FROM df_... GROUP BY ref_area")| Type | Name | Description |
|---|---|---|
| Resource | oecd://dataflow/{agency_id}/{flow_id} | Dimension metadata for a single OECD dataflow — same content as oecd_get_dataset_info |
{flow_id} is the combined {dsd_id}@{df_id} string with @ percent-encoded as %40. Example: oecd://dataflow/OECD.SDD.NAD/DSD_NAAG%40DF_NAAG_I.
All resource data is also reachable via tools. Use oecd_get_dataset_info for the same content.
Built on @cyanheads/mcp-ts-core:
none, jwt, oauthin-memory, filesystem, Supabase, Cloudflare KV/R2/D1OECD-specific:
AllDimensions observation mode — one-pass SDMX-JSON decoding into flat row objects; no nested series key reconstructionoecd_query_dataset materializes large observation sets (multi-country time-series) on a DuckDB DataCanvas for in-conversation SQL analyticssource: "OECD") on every observation row per OECD terms of useAgent-friendly output:
flow_ref from search flows directly into info, values, and query tools without reconstructiontruncated: true + canvas_id tells the agent to switch to SQL instead of parsing a truncated inline list{ ref_area: "United States", measure: "Gross domestic product", obs_value: 26054 }, not raw index arraysAdd the following to your MCP client configuration file.
{
"mcpServers": {
"oecd-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/oecd-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"oecd-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/oecd-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with Docker:
{
"mcpServers": {
"oecd-mcp-server": {
"type": "stdio",
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "MCP_TRANSPORT_TYPE=stdio",
"ghcr.io/cyanheads/oecd-mcp-server:latest"
]
}
}
}To enable DataCanvas SQL analytics for large query results, add CANVAS_PROVIDER_TYPE=duckdb:
{
"mcpServers": {
"oecd-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/oecd-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"CANVAS_PROVIDER_TYPE": "duckdb"
}
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http
# Server listens at http://localhost:3010/mcpgit clone https://github.com/cyanheads/oecd-mcp-server.gitcd oecd-mcp-serverbun installcp .env.example .env
# edit .env — most vars are optional; no API key requiredAll configuration is validated at startup via Zod schemas in src/config/server-config.ts. Key environment variables:
| Variable | Description | Default |
|---|---|---|
OECD_BASE_URL | OECD SDMX REST API base URL. | https://sdmx.oecd.org/public/rest |
OECD_TIMEOUT_MS | Per-request timeout in milliseconds. | 30000 |
CANVAS_PROVIDER_TYPE | Canvas engine. Set to duckdb to enable DataCanvas for large oecd_query_dataset results. | none |
MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio |
MCP_HTTP_PORT | Port for HTTP server. | 3010 |
MCP_AUTH_MODE | Auth mode: none, jwt, or oauth. | none |
MCP_LOG_LEVEL | Log level (RFC 5424). | info |
LOGS_DIR | Directory for log files (Node.js only). | <project-root>/logs |
OTEL_ENABLED | Enable OpenTelemetry instrumentation. | false |
See .env.example for the full list of optional overrides.
# One-time build
bun run rebuild
# Run the built server
bun run start:stdio
# or
bun run start:http bun run devcheck # Lint, format, typecheck, security
bun run test # Vitest test suite
bun run lint:mcp # Validate MCP definitions against specdocker build -t oecd-mcp-server .
docker run --rm -p 3010:3010 oecd-mcp-serverThe Dockerfile defaults to HTTP transport, stateless session mode, and logs to /var/log/oecd-mcp-server. OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them.
| Directory | Purpose |
|---|---|
src/index.ts | createApp() entry point — registers tools/resources and initializes services. |
src/config/ | Server-specific environment variable parsing and validation with Zod. |
src/mcp-server/tools/definitions/ | Tool definitions (*.tool.ts) — seven tools for OECD data discovery and retrieval. |
src/mcp-server/resources/definitions/ | Resource definitions (*.resource.ts) — the oecd://dataflow resource. |
src/services/oecd-structure/ | OECD SDMX structure service — dataflows, data structures, codelists. |
src/services/oecd-data/ | OECD SDMX data service — observations, SDMX-JSON decoding, DataCanvas spillover. |
src/services/canvas-accessor/ | DataCanvas accessor — registers and exposes the framework canvas instance to tools. |
tests/ | Unit and integration tests mirroring src/. |
See CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for request-scoped logging, ctx.state for tenant-scoped storagesrc/mcp-server/*/index.tsIssues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.