.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/reference-data-mcp-server</h1> <p><b>Look up countries, timezones, periodic table elements, physical constants, units, HTTP status codes, and MIME types via MCP. STDIO or Streamable HTTP.</b> <div>10 Tools • 3 Resources</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://reference-data.caseyjhand.com/mcp
</div>
Ten tools grouped by domain — geo, timezone, periodic table, physical constants, unit conversion, HTTP, and web:
| Tool | Description |
|---|---|
ref_geo_lookup | Look up a country by name, ISO alpha-2, or alpha-3 code. Returns capital, region, languages, currencies, calling codes, TLD, flag, and IANA timezone IDs. |
ref_geo_search | Search and filter countries by region, subregion, language, currency, or free-text keyword. |
ref_timezone_lookup | Get timezone info by IANA ID, country code, or partial city/region name. Returns current and standard UTC offsets, DST status, and major cities. |
ref_timezone_convert | Convert a local datetime from one timezone to another, with visible UTC offsets for both sides. |
ref_element_lookup | Look up a periodic table element by name, symbol, or atomic number. Full property set including atomic mass, electron configuration, electronegativity, density, melting/boiling points, and discovery data. |
ref_element_search | Filter elements by category, group, period, atomic number range, or atomic mass range. |
ref_constant_lookup | Look up a CODATA 2022 physical constant by name, symbol, or alias. Returns value, SI unit, uncertainty, and related constants. |
ref_unit_convert | Convert a numeric value between compatible units of measure (length, mass, volume, temperature, speed, pressure, energy, power, frequency, digital storage, angle). |
ref_http_status | Look up an HTTP status code by number or keyword. Returns reason phrase, description, category, cacheability, and RFC reference. |
ref_mime_type | Look up a MIME type by type string or file extension. Returns canonical type, extensions, compressibility, and data source. |
ref_geo_lookupLook up a country by name, ISO alpha-2 or alpha-3 code.
auto (tries alpha-2, alpha-3, then name), name, alpha2, alpha3ref_geo_searchSearch and filter countries with at least one filter required.
truncated flag when results are cut offref_timezone_lookupGet timezone info for an IANA ID, country code, or city name.
at parameter evaluates DST state at a specific ISO 8601 momentref_timezone_convertConvert a local datetime between timezones.
"2026-05-24T15:30:00")ref_element_lookupLook up any of the 118 periodic table elements.
null for experimentally inaccessible propertiesref_element_searchFilter elements across the full periodic table.
ref_constant_lookupLook up CODATA 2022 physical constants (~360 entries).
ref_unit_convertConvert between units in 11 measurement domains.
ref_http_statusLook up HTTP status codes by number or keyword.
"404") return an exact match"not found", "too many requests") return the closest match plus alternativesref_mime_typeLook up MIME types by type string or file extension.
"image/webp", ".webp", or "webp" interchangeably| Type | Name | Description |
|---|---|---|
| Resource | ref://countries/{alpha2} | Full country record by ISO alpha-2 code (e.g., ref://countries/DE). |
| Resource | ref://elements/{number} | Full element record by atomic number (e.g., ref://elements/6 for Carbon). |
| Resource | ref://timezones/{iana_id} | Timezone info by IANA ID with slashes URL-encoded as %2F (e.g., ref://timezones/America%2FNew_York). |
All resource data is also reachable via tools. Use ref_geo_lookup, ref_element_lookup, and ref_timezone_lookup when you need flexible query modes or country search.
Built on @cyanheads/mcp-ts-core:
none, jwt, oauthin-memory, filesystem, Supabase, Cloudflare KV/R2/D1Reference-data-specific:
Agent-friendly output:
reason codes (no_match, no_filters, unknown_unit, incompatible_units, below_absolute_zero, invalid_timezone, invalid_datetime) with actionable recovery hintstruncated flag on search results, alternatives arrays on MIME/HTTP keyword matches, atomic_mass_estimated flag on element datanull for genuinely unknown or inapplicable values rather than absent fieldsAdd the following to your MCP client configuration file:
{
"mcpServers": {
"reference-data-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/reference-data-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"reference-data-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/reference-data-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with Docker:
{
"mcpServers": {
"reference-data-mcp-server": {
"type": "stdio",
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "MCP_TRANSPORT_TYPE=stdio",
"ghcr.io/cyanheads/reference-data-mcp-server:latest"
]
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http
# Server listens at http://localhost:3010/mcpgit clone https://github.com/cyanheads/reference-data-mcp-server.gitcd reference-data-mcp-serverbun installcp .env.example .env
# edit .env if you want to override transport or logging defaultsNo API keys are required. All configuration is optional overrides of framework defaults.
| Variable | Description | Default |
|---|---|---|
MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio |
MCP_HTTP_PORT | Port for HTTP server. | 3010 |
MCP_HTTP_HOST | Host for HTTP server. | 127.0.0.1 |
MCP_AUTH_MODE | Auth mode: none, jwt, or oauth. | none |
MCP_LOG_LEVEL | Log level (RFC 5424): debug, info, notice, warning, error. | info |
LOGS_DIR | Directory for log files (Node.js only). | <project-root>/logs |
OTEL_ENABLED | Enable OpenTelemetry instrumentation (spans, metrics, completion logs). | false |
See .env.example for the full list of optional overrides.
# One-time build
bun run rebuild
# Run the built server
bun run start:stdio
# or
bun run start:httpbun run devcheck # Lint, format, typecheck, security
bun run test # Vitest test suite
bun run lint:mcp # Validate MCP definitions against specdocker build -t reference-data-mcp-server .
docker run --rm -p 3010:3010 reference-data-mcp-serverThe Dockerfile defaults to HTTP transport, stateless session mode, and logs to /var/log/reference-data-mcp-server. OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them.
| Directory | Purpose |
|---|---|
src/index.ts | createApp() entry point — registers tools/resources and inits services. |
src/data/ | Static datasets (periodic table, physical constants, HTTP status codes). |
src/mcp-server/tools/ | Tool definitions (*.tool.ts). |
src/mcp-server/resources/ | Resource definitions (*.resource.ts). |
src/services/ | Domain service integrations (geo, timezone, elements, constants, units, http-status, mime). |
tests/ | Unit tests mirroring src/. |
docs/ | Generated docs (tree.md, design.md). |
changelog/ | Per-version changelog files. |
See CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for request-scoped logging, ctx.state for tenant-scoped storagesrc/index.tsIssues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.