.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/openchargemap-mcp-server</h1> <p><b>Find EV charging stations by location and connector, get full station detail, resolve reference IDs, and read community reliability check-ins via MCP. STDIO or Streamable HTTP.</b> <div>4 Tools • 1 Resource</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://openchargemap.caseyjhand.com/mcp
</div>
Four tools across the find-and-detail surface — search, detail, offline ID resolution, and the community reliability layer:
| Tool | Description |
|---|---|
openchargemap_find_stations | Find charging stations near a point or within a bounding box, filtered by connector, power, network, usage, status, and charge points. Coordinate-native. |
openchargemap_get_station | Full record for one station by numeric OCM ID — every connection, operator, access rules, charge points, cost, media, and a computed reliability note. |
openchargemap_lookup_reference | Resolve connector/operator/usage/status/country names to the integer filter IDs find_stations needs. Served from a bundled snapshot — offline and instant. |
openchargemap_get_station_comments | Community check-ins for one station alongside the registry status and last-verified date, so registry-vs-reality mismatch is visible. |
openchargemap_find_stationsThe workhorse. Search the global registry by location, then narrow with filters.
latitude + longitude + distance, in KM or Miles) or boundingbox — exactly one mode per callcountrycode; global by default, no implicit countryopenchargemap_lookup_reference first (e.g. "CCS" → 33)dateLastVerifiedmaxresults caps the set (default 25, max 200), ordered by distance; truncation is disclosed when the cap is hitopenstreetmap MCP server's openstreetmap_geocode) first, then pass them hereopenchargemap_get_stationFull detail for one station by its numeric OCM ID (fetched with verbose=true).
includeCommentsreliabilityNote from observable facts (verification age, operational flag, fault-vs-positive comment counts) — no synthetic score; omitted when status is fresh and uncontestedopenchargemap_find_stations. UUID lookup is not supported by the OCM API.openchargemap_lookup_referenceResolve Open Charge Map reference data to the integer IDs the find_stations filters require — served from a bundled snapshot, so it makes no network call (offline, instant).
connectiontypes, operators, usagetypes, statustypes, currenttypes, levels, countriesquery to resolve a name, title, code, or alias ("CCS", "Tesla Supercharger", "ChargePoint", "Public - Pay At Location", "France", "FR") — case-insensitive, matched on title, formal name, and curated connector aliasesquery to browse the whole category (up to limit, max 100)id(s) plus the filterParam they feed and the snapshot vintage (snapshotDate)OPENCHARGEMAP_REFERENCE_REFRESH belowopenchargemap_get_station_commentsCommunity check-ins for one station — the honest reliability signal beyond the operator-reported registry flag.
maxresults caps, max 100)dateLastVerified alongside the comments so you can flag mismatches like "listed operational, but recent check-ins report a fault"comments: []; absence of reports is not evidence the charger worksincludecomments=true (OCM has no standalone comments endpoint)openchargemap_find_stations| Type | Name | Description |
|---|---|---|
| Resource | openchargemap://station/{id} | Full station record (with community comments) by numeric OCM ID — the URI-addressable twin of openchargemap_get_station. |
All station data is also reachable via the tools. The station corpus (~200k locations, geo-scoped) is not exposed as a listable resource — discover stations with openchargemap_find_stations. Reference data is a resolve surface, not a stable-by-URI record, so it is served by openchargemap_lookup_reference rather than a resource.
Built on @cyanheads/mcp-ts-core:
none, jwt, oauthin-memory, filesystem, Supabase, Cloudflare KV/R2/D1Open Charge Map–specific:
/referencedata call, with an optional startup refresh to prevent driftCCS, NACS/Supercharger, J1772, Type 2, CHAdeMO) so the names agents actually use resolve to the right IDsAgent-friendly output:
status, isOperational, and dateLastVerified on every station, plus a plain-prose reliabilityNote derived only from observable facts (no fabricated confidence score)A public instance is available at https://openchargemap.caseyjhand.com/mcp — no installation required. Point any MCP client at it via Streamable HTTP, with this client config:
{
"mcpServers": {
"openchargemap-mcp-server": {
"type": "streamable-http",
"url": "https://openchargemap.caseyjhand.com/mcp"
}
}
}Add the following to your MCP client configuration file. An Open Charge Map API key is required — see Prerequisites.
{
"mcpServers": {
"openchargemap-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/openchargemap-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info",
"OPENCHARGEMAP_API_KEY": "your-api-key"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"openchargemap-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/openchargemap-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info",
"OPENCHARGEMAP_API_KEY": "your-api-key"
}
}
}
}Or with Docker:
{
"mcpServers": {
"openchargemap-mcp-server": {
"type": "stdio",
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "MCP_TRANSPORT_TYPE=stdio",
"-e", "OPENCHARGEMAP_API_KEY=your-api-key",
"ghcr.io/cyanheads/openchargemap-mcp-server:latest"
]
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 OPENCHARGEMAP_API_KEY=... bun run start:http
# Server listens at http://localhost:3010/mcpX-API-Key header on every request; the server fails fast at startup if it's unset.git clone https://github.com/cyanheads/openchargemap-mcp-server.gitcd openchargemap-mcp-serverbun installcp .env.example .env
# edit .env and set OPENCHARGEMAP_API_KEYAll configuration is validated at startup via Zod schemas in src/config/server-config.ts. Key environment variables:
| Variable | Description | Default |
|---|---|---|
OPENCHARGEMAP_API_KEY | Required. Open Charge Map API key, sent as the X-API-Key header. Free signup at openchargemap.org. | — |
OPENCHARGEMAP_BASE_URL | OCM API base URL. Override for a private mirror or testing. | https://api.openchargemap.io/v3 |
OPENCHARGEMAP_REFERENCE_REFRESH | When true, refresh reference data from the live /referencedata endpoint at startup, falling back to the bundled snapshot on failure. When false, stay fully offline on the bundled snapshot. | false |
MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio |
MCP_HTTP_PORT | Port for the HTTP server. | 3010 |
MCP_AUTH_MODE | Auth mode: none, jwt, or oauth. | none |
MCP_LOG_LEVEL | Log level (RFC 5424). | info |
LOGS_DIR | Directory for log files (Node.js only). | <project-root>/logs |
STORAGE_PROVIDER_TYPE | Storage backend. | in-memory |
OTEL_ENABLED | Enable OpenTelemetry instrumentation (spans, metrics, completion logs). | false |
See .env.example for the full list of optional overrides.
# One-time build
bun run rebuild
# Run the built server
bun run start:stdio
# or
bun run start:http bun run devcheck # Lint, format, typecheck, security, changelog sync
bun run test # Vitest test suite
bun run lint:mcp # Validate MCP definitions against specdocker build -t openchargemap-mcp-server .
docker run --rm -e OPENCHARGEMAP_API_KEY=your-key -p 3010:3010 openchargemap-mcp-serverThe Dockerfile defaults to HTTP transport, stateless session mode, and logs to /var/log/openchargemap-mcp-server. OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them.
| Directory | Purpose |
|---|---|
src/index.ts | createApp() entry point — registers tools/resources and inits services. |
src/config | Server-specific environment variable parsing and validation with Zod. |
src/data | Bundled Open Charge Map reference snapshot (ocm-reference-data.ts) — the offline source for ID resolution. |
src/mcp-server/tools | Tool definitions (*.tool.ts) plus the shared station schema and renderers. |
src/mcp-server/resources | Resource definitions (*.resource.ts). |
src/services/openchargemap | OCM POI API client, response normalization, attribution, and the reliability-note helper. |
src/services/reference-data | Reference-data service — snapshot loading, lookup indices, curated aliases, optional live refresh. |
tests/ | Unit and integration tests mirroring src/. |
See AGENTS.md (and CLAUDE.md) for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for request-scoped logging, ctx.state for tenant-scoped storagecreateApp() arraysCharging-station, connector, and operator data is sourced from [Open Charge Map](https://openchargemap.org), the community-maintained global registry of EV charging locations, and is licensed under CC BY 4.0.
Station data © Open Charge Map contributors, licensed under CC BY 4.0 (openchargemap.org).
Attribution is mandatory: every tool response carries this attribution string, and the server restates it in its session-level instructions. Any downstream use of the data must credit Open Charge Map and its contributors. This server's own code is Apache-2.0 (below); the license terms above apply to the data, not the software.
Issues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details. Open Charge Map data carries its own license; see Attribution and data license.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.