.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/openlibrary-mcp-server</h1> <p><b>Search books and authors, fetch editions, browse subjects, and resolve cover images from Open Library via MCP. STDIO or Streamable HTTP.</b> <div>9 Tools • 2 Resources</div> </p> </div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://openlibrary.caseyjhand.com/mcp
</div>
9 tools for working with Open Library's catalog of 20M+ books, editions, authors, and subjects:
| Tool | Description |
|---|---|
openlibrary_search_books | Full-text book search with field filters (title, author, subject, publisher, ISBN, language), sort options, pagination, and optional live reading availability |
openlibrary_get_work | Fetch a work by Open Library Work ID (OL…W) — title, description, subjects, cover IDs, and author IDs |
openlibrary_get_editions | List editions of a work — publishers, languages, formats, ISBNs, and print run details |
openlibrary_get_edition | Fetch a single edition by ISBN-10, ISBN-13, OCLC, LCCN, or Open Library Edition ID (OL…M) |
openlibrary_search_authors | Search authors by name — returns Author IDs, birth/death dates, top works, and subject associations |
openlibrary_get_author | Fetch author detail by Open Library Author ID (OL…A) — bio, dates, photo IDs, and linked identifiers from Wikidata, VIAF, ISNI, Goodreads, and LibraryThing |
openlibrary_get_author_works | List works by an author — titles, cover IDs, and Work OLIDs for drilling into editions or details |
openlibrary_get_subject | Browse works by subject tag — returns matching works with edition counts and cover IDs plus the total work count |
openlibrary_get_cover_url | Resolve a cover image URL for a book or author photo in S/M/L size — returns a direct HTTPS URL embeddable in markdown |
openlibrary_search_booksFull-text book search across Open Library works.
title:, author:, subject:, publisher:, isbn:, language:openlibrary_get_workFetch a work by Open Library Work ID (OL…W).
openlibrary_get_author or openlibrary_search_books for namesopenlibrary_get_editionsList editions of a work — different publishers, languages, formats, and print runs.
openlibrary_get_work or openlibrary_search_books to find a specific printingopenlibrary_get_editionFetch a single edition by identifier.
id_type "isbn" for both ISBN-10 and ISBN-13openlibrary_search_authorsSearch Open Library authors by name.
openlibrary_get_author (bio, remote IDs) or openlibrary_get_author_works (list of works)openlibrary_get_authorFetch author detail by Open Library Author ID (OL…A).
openlibrary_search_authors to find an author ID firstopenlibrary_get_author_worksList works by an author.
openlibrary_get_author for author bio and details, or openlibrary_get_editions to explore specific printingsopenlibrary_get_subjectBrowse works by subject tag.
openlibrary_get_cover_urlResolve a cover image URL for a book or author photo.
| Type | Name | Description |
|---|---|---|
| Resource | openlibrary://works/{work_id} | Work detail by Open Library Work ID — title, description, subjects, cover IDs, and author IDs as injectable context |
| Resource | openlibrary://authors/{author_id} | Author detail by Open Library Author ID — name, bio, dates, photo IDs, and linked external identifiers as injectable context |
Built on @cyanheads/mcp-ts-core:
none, jwt, oauth)in-memory, filesystem, Supabase, Cloudflare KV/R2/D1Open Library-specific:
User-Agent header for well-behaved bot identification per community conventionAgent-friendly output:
Add the following to your MCP client configuration file.
{
"mcpServers": {
"openlibrary-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/openlibrary-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"openlibrary-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/openlibrary-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with Docker:
{
"mcpServers": {
"openlibrary-mcp-server": {
"type": "stdio",
"command": "docker",
"args": ["run", "-i", "--rm", "-e", "MCP_TRANSPORT_TYPE=stdio", "ghcr.io/cyanheads/openlibrary-mcp-server:latest"]
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http
# Server listens at http://localhost:3010/mcpgit clone https://github.com/cyanheads/openlibrary-mcp-server.gitcd openlibrary-mcp-serverbun installAll configuration is validated at startup via Zod schemas in src/config/server-config.ts. Key environment variables:
| Variable | Description | Default |
|---|---|---|
MCP_TRANSPORT_TYPE | Transport: stdio or http | stdio |
MCP_HTTP_PORT | HTTP server port | 3010 |
MCP_HTTP_ENDPOINT_PATH | HTTP endpoint path where the MCP server is mounted | /mcp |
MCP_PUBLIC_URL | Public origin override for TLS-terminating reverse-proxy deployments | none |
MCP_AUTH_MODE | Authentication: none, jwt, or oauth | none |
MCP_LOG_LEVEL | Log level (debug, info, warning, error, etc.) | info |
MCP_GC_PRESSURE_INTERVAL_MS | Opt-in Bun-only forced-GC pressure loop (ms). Recommended starting point if heap growth is observed: 60000. | 0 (disabled) |
LOGS_DIR | Directory for log files (Node.js only) | <project-root>/logs |
STORAGE_PROVIDER_TYPE | Storage backend: in-memory, filesystem, supabase, cloudflare-kv/r2/d1 | in-memory |
OPENLIBRARY_USER_AGENT | User-Agent sent with all Open Library API requests. Include a contact email per community convention. | openlibrary-mcp-server/1.0 ([email protected]) |
OTEL_ENABLED | Enable OpenTelemetry | false |
# One-time build
bun run rebuild
# Run the built server
bun run start:http
# or
bun run start:stdio bun run devcheck # Lints, formats, type-checks, and more
bun run test # Runs the test suite| Directory | Purpose |
|---|---|
src/mcp-server/tools | Tool definitions (*.tool.ts). Nine tools across Search, Books, Authors, Subjects, and Covers. |
src/mcp-server/resources | Resource definitions. Work and Author resources. |
src/services/open-library | Open Library service layer — API client and domain types. |
src/config | Server-specific environment variable parsing and validation with Zod. |
tests/ | Unit and integration tests, mirroring the src/ structure. |
See CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for logging, ctx.state for storagecreateApp() arraysIssues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testThis project is licensed under the Apache 2.0 License. See the LICENSE file for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.