.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/reliefweb-mcp-server</h1> <p><b>Search ReliefWeb humanitarian reports, disasters, jobs, training, and country profiles via MCP. STDIO or Streamable HTTP.</b> <div>9 Tools • 3 Resources • 1 Prompt</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://reliefweb.caseyjhand.com/mcp
</div>
9 tools for working with ReliefWeb humanitarian data:
| Tool | Description |
|---|---|
reliefweb_search_reports | Search humanitarian reports with filtering by country, disaster, format, theme, language, source, and date |
reliefweb_get_report | Fetch a single report by numeric ID with full body text and metadata |
reliefweb_search_disasters | Search disasters by type, country, status, GLIDE number, and date range |
reliefweb_get_disaster | Fetch a disaster record with profile, key content links, appeals, and response plans |
reliefweb_get_country | Fetch a country profile by ISO3 code with overview, appeals, and curated links |
reliefweb_list_countries | List all countries tracked by ReliefWeb, filterable to active humanitarian situations |
reliefweb_search_jobs | Search humanitarian job listings by country, organization, career category, and experience level |
reliefweb_search_training | Search training and learning opportunities by format, country, career category, and date |
reliefweb_list_sources | Browse contributing organizations by name and type |
reliefweb_search_reportsSearch humanitarian reports on ReliefWeb with rich filtering.
include_archived=true for historical research (includes expired and archived content)reliefweb_get_report to fetch full body textreliefweb_get_reportFetch a single ReliefWeb report by its numeric ID with full body text.
reliefweb_search_reports to retrieve document content (10–100KB each)not_found when the ID doesn't existreliefweb_search_disastersSearch active and historical disasters on ReliefWeb.
alert, current, past, alert-archive, archive; multiple values comma-separatedinclude_archived=true for historical researchreliefweb_get_disaster and as disaster_id filter in reliefweb_search_reportsreliefweb_get_disasterFetch a disaster record by ReliefWeb numeric ID with full details.
reliefweb_get_countryFetch a country profile from ReliefWeb by ISO3 code.
reliefweb_list_countriesList all countries and territories tracked by ReliefWeb.
crisis_only=true to limit to active humanitarian situations (status alert or current)reliefweb_get_countryreliefweb_search_jobsSearch humanitarian job listings on ReliefWeb.
reliefweb_search_trainingSearch humanitarian training and learning opportunities.
date_start_from / date_start_to)date.start / date.endreliefweb_list_sourcesBrowse organizations that contribute content to ReliefWeb.
shortname with the source filter in reliefweb_search_reports, reliefweb_search_jobs, and reliefweb_search_training| Type | Name | Description |
|---|---|---|
| Resource | reliefweb://reports/{id} | Full report record by numeric ID — metadata, body text, and file URLs |
| Resource | reliefweb://disasters/{id} | Disaster record by numeric ID — type, status, GLIDE, description, and content links |
| Resource | reliefweb://countries/{iso3} | Country profile by ISO3 code — overview, situation summary, and active response plans |
| Prompt | reliefweb_crisis_briefing | Generate a structured humanitarian briefing for a country or disaster |
Built on @cyanheads/mcp-ts-core:
none, jwt, oauth)in-memory, filesystem, Supabase, Cloudflare KV/R2/D1ReliefWeb-specific:
RELIEFWEB_APP_NAME validated at startup (required by the API since November 2025)Agent-friendly output:
reliefweb_get_report to control context budgetnot_found error contracts on get-by-ID tools with actionable recovery textRELIEFWEB_APP_NAME. The API has required pre-approved appnames since November 2025; requests without one are rejected.A public instance is available at https://reliefweb.caseyjhand.com/mcp — no installation required. Point any MCP client at it via Streamable HTTP:
{
"mcpServers": {
"reliefweb-mcp-server": {
"type": "streamable-http",
"url": "https://reliefweb.caseyjhand.com/mcp"
}
}
}Add the following to your MCP client configuration file.
{
"mcpServers": {
"reliefweb-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/reliefweb-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info",
"RELIEFWEB_APP_NAME": "your-app-name"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"reliefweb-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/reliefweb-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info",
"RELIEFWEB_APP_NAME": "your-app-name"
}
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 RELIEFWEB_APP_NAME=your-app-name bun run start:http
# Server listens at http://localhost:3010/mcpgit clone https://github.com/cyanheads/reliefweb-mcp-server.gitcd reliefweb-mcp-serverbun installAll configuration is validated at startup via Zod schemas. Key environment variables:
| Variable | Description | Default |
|---|---|---|
RELIEFWEB_APP_NAME | Required. Pre-approved appname for the ReliefWeb API v2. Register at reliefweb.int/help/api. | — |
MCP_TRANSPORT_TYPE | Transport: stdio or http | stdio |
MCP_HTTP_PORT | HTTP server port | 3010 |
MCP_HTTP_ENDPOINT_PATH | HTTP endpoint path where the MCP server is mounted | /mcp |
MCP_PUBLIC_URL | Public origin override for TLS-terminating reverse-proxy deployments | none |
MCP_AUTH_MODE | Authentication: none, jwt, or oauth | none |
MCP_LOG_LEVEL | Log level (debug, info, warning, error, etc.) | info |
MCP_GC_PRESSURE_INTERVAL_MS | Opt-in Bun-only forced-GC pressure loop (ms). Try 60000 if heap growth is observed under sustained HTTP load. | 0 (disabled) |
LOGS_DIR | Directory for log files (Node.js only). | <project-root>/logs |
STORAGE_PROVIDER_TYPE | Storage backend: in-memory, filesystem, supabase, cloudflare-kv/r2/d1 | in-memory |
OTEL_ENABLED | Enable OpenTelemetry | false |
# One-time build
bun run rebuild
# Run the built server
bun run start:http
# or
bun run start:stdio bun run devcheck # Lints, formats, type-checks, and more
bun run test # Runs the test suite| Directory | Purpose |
|---|---|
src/mcp-server/tools | Tool definitions (*.tool.ts). Nine tools across reports, disasters, countries, jobs, training, and sources. |
src/mcp-server/resources | Resource definitions. Report, disaster, and country resources. |
src/mcp-server/prompts | Prompt definitions. Crisis briefing prompt. |
src/services/reliefweb | ReliefWeb API service layer — HTTP client, filter builder, and response normalizers for all six content types. |
src/config | Server-specific environment variable parsing and validation with Zod. |
tests/ | Unit and integration tests, mirroring the src/ structure. |
See CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for logging, ctx.state for storagecreateApp() arraysIssues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testThis project is licensed under the Apache 2.0 License. See the LICENSE file for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.