.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/openfec-mcp-server</h1> <p><b>Access FEC campaign finance data through MCP. Query data about candidates, money trails, and election filings. STDIO & Streamable HTTP.</b> <div>9 Tools • 5 Resources • 2 Prompts</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://openfec.caseyjhand.com/mcp
</div>
Nine tools for querying federal election campaign finance data:
| Tool Name | Description |
|---|---|
openfec_search_candidates | Find federal candidates by name, state, office, party, or cycle. |
openfec_search_committees | Find political committees by name, type, candidate affiliation, or state. |
openfec_search_contributions | Search itemized individual contributions or aggregate breakdowns by size, state, employer, or occupation. |
openfec_search_disbursements | Search itemized committee spending or aggregate breakdowns by purpose or recipient. |
openfec_search_expenditures | Search independent expenditures supporting or opposing federal candidates. |
openfec_search_filings | Search FEC filings and reports by committee, candidate, form type, or date range. |
openfec_lookup_elections | Look up election races and candidate financial summaries. |
openfec_search_legal | Search FEC legal documents: advisory opinions, enforcement cases, and administrative fines. |
openfec_lookup_calendar | Look up FEC calendar events, filing deadlines, and election dates. |
openfec_search_candidatesFind federal candidates with optional financial totals.
openfec_search_committeesFind political committees (campaign, PAC, Super PAC, party).
openfec_search_contributionsSearch Schedule A contribution data with five query modes.
openfec_search_disbursementsSearch Schedule B spending data with four query modes.
openfec_search_expendituresSearch Schedule E independent expenditure data.
openfec_search_filingsSearch FEC filings and reports.
openfec_search_legalSearch across FEC legal document types.
openfec_lookup_electionsLook up federal election races.
openfec_lookup_calendarLook up FEC dates and deadlines.
| URI Pattern | Description |
|---|---|
openfec://candidate/{candidate_id} | Federal candidate profile with current financial totals. |
openfec://committee/{committee_id} | Political committee profile with type, designation, and financial summary. |
openfec://election/{cycle}/{office} | Presidential or at-large election race with candidate financial totals. |
openfec://election/{cycle}/{office}/{state} | Senate or state-level election race with candidate financial totals. |
openfec://election/{cycle}/{office}/{state}/{district} | House district election race with candidate financial totals. |
| Prompt | Description |
|---|---|
openfec_campaign_analysis | Structured analysis of a candidate's financial position — fundraising trajectory, burn rate, cash reserves, donor composition, and opponent comparison. |
openfec_money_trail | Framework for tracing the flow of money around a candidate or race — direct fundraising, PAC support, independent expenditures, and party spending. |
Built on @cyanheads/mcp-ts-core:
none, jwt, oauth)in-memory, filesystem, Supabase, Cloudflare KV/R2/D1OpenFEC-specific:
A public instance is available at https://openfec.caseyjhand.com/mcp — no installation required. Point any MCP client at it via Streamable HTTP:
{
"mcpServers": {
"openfec-mcp-server": {
"type": "streamable-http",
"url": "https://openfec.caseyjhand.com/mcp"
}
}
}Add the following to your MCP client configuration file.
{
"mcpServers": {
"openfec-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/openfec-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"FEC_API_KEY": "your-api-key"
}
}
}
}Or with Docker:
{
"mcpServers": {
"openfec-mcp-server": {
"type": "stdio",
"command": "docker",
"args": ["run", "-i", "--rm", "-e", "MCP_TRANSPORT_TYPE=stdio", "-e", "FEC_API_KEY=your-api-key", "ghcr.io/cyanheads/openfec-mcp-server:latest"]
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 FEC_API_KEY=your-key bun run start:http
# Server listens at http://localhost:3010/mcpDEMO_KEY)git clone https://github.com/cyanheads/openfec-mcp-server.gitcd openfec-mcp-serverbun install| Variable | Description | Default |
|---|---|---|
FEC_API_KEY | OpenFEC API key. Optional — defaults to DEMO_KEY (30 req/hr). Provide your own key (free at api.data.gov/signup) for 1,000 req/hr. | DEMO_KEY |
FEC_BASE_URL | OpenFEC API base URL. | https://api.open.fec.gov/v1 |
FEC_MAX_RETRIES | Max retry attempts for failed API requests. | 3 |
FEC_REQUEST_TIMEOUT | Request timeout in milliseconds. | 30000 |
MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio |
MCP_HTTP_PORT | Port for HTTP server. | 3010 |
MCP_HTTP_HOST | Hostname for HTTP server. | localhost |
MCP_AUTH_MODE | Auth mode: none, jwt, or oauth. | none |
MCP_LOG_LEVEL | Log level (RFC 5424). | info |
LOGS_DIR | Directory for log files (Node.js only). | <project-root>/logs |
STORAGE_PROVIDER_TYPE | Storage backend. | in-memory |
OTEL_ENABLED | Enable OpenTelemetry instrumentation (spans, metrics, completion logs). | false |
bun run rebuild
bun run start:stdio # or start:http bun run devcheck # Lint, format, typecheck, security audit
bun run test # Runs test suite| Directory | Purpose |
|---|---|
src/mcp-server/tools/definitions/ | Tool definitions (*.tool.ts). |
src/mcp-server/resources/definitions/ | Resource definitions (*.resource.ts). |
src/mcp-server/prompts/definitions/ | Prompt definitions (*.prompt.ts). |
src/services/openfec/ | OpenFEC API client and domain types. |
src/config/ | Environment variable parsing and validation with Zod. |
tests/ | Unit and integration tests. |
scripts/ | Build, clean, devcheck, tree, and lint scripts. |
docs/ | Design docs and OpenAPI spec. |
See CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for domain-specific logging, ctx.state for storageindex.ts barrel filesIssues and pull requests are welcome. Run checks before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.