reliefweb-mcp-server-216ddf — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited reliefweb-mcp-server-216ddf (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/reliefweb-mcp-server</h1> <p><b>Search ReliefWeb humanitarian reports, disasters, jobs, training, and country profiles via MCP. STDIO or Streamable HTTP.</b> <div>11 Tools • 3 Resources • 1 Prompt • 1 Skill</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://reliefweb.caseyjhand.com/mcp
</div>
Humanitarian reports, disasters, jobs, training, and country profiles from ReliefWeb, OCHA's information hub for crisis response. Search and read across every ReliefWeb content type.
| Tool | Description |
|---|---|
reliefweb_search_reports | Search humanitarian reports with filtering by country, disaster, format, theme, language, source, and date |
reliefweb_get_report | Fetch a single report by numeric ID with full body text and metadata |
reliefweb_search_disasters | Search disasters by type, country, status, GLIDE number, and date range |
reliefweb_get_disaster | Fetch a disaster record with profile, key content links, appeals, and response plans |
reliefweb_get_country | Fetch a country profile by ISO3 code with overview, appeals, and curated links |
reliefweb_list_countries | List all countries tracked by ReliefWeb, filterable to active humanitarian situations |
reliefweb_search_jobs | Search humanitarian job listings by country, organization, career category, and experience level |
reliefweb_get_job | Fetch a job posting by numeric ID with the full vacancy description and application instructions |
reliefweb_search_training | Search training by format, country, career category, cost, listing or delivery language, and date — upcoming starts by default |
reliefweb_get_training | Fetch a training listing by numeric ID with the full description, registration instructions, and cost detail |
reliefweb_list_sources | Browse contributing organizations by name and type |
| Resource | Description |
|---|---|
reliefweb://reports/{id} | Full report record by numeric ID — metadata, body text, and file URLs. The ID segment must be digits only |
reliefweb://disasters/{id} | Disaster record by numeric ID — type, status, GLIDE, description, and content links. The ID segment must be digits only |
reliefweb://countries/{iso3} | Country profile by ISO3 code — overview, situation summary, and active response plans |
| Prompt | Description |
|---|---|
reliefweb_crisis_briefing | Generate a structured humanitarian briefing for a country or disaster |
Search/list page limits above 1,000 and profile-archive limits above 100 are clamped with a notice showing the requested and applied values. Defaults are unchanged: 10 for searches and sources, 100 for countries, 25 for profile archives. Set RELIEFWEB_CLAMP_LIMITS=false to restore strict upper-bound validation. Zero, negative, and fractional limits are always rejected.
reliefweb_search_reports <sub>tool</sub>date_from/date_to) — a bare 2024-01-15 works alongside full ISO 8601News and Press Release, Situation Report, Map, Infographic, Analysis, Other, Assessment, Manual and Guideline, Appeal, UN Document, Evaluation and Lessons Learned — matched ignoring case, spacing, and punctuation; anything else is rejected with the listfilter object for compound conditions the named params don't coveroffset/limit, up to 1,000 per call (default 10)include_archived has no effect — reports carry no archived class, so every report is already in scopereliefweb_get_report <sub>tool</sub>reliefweb_search_reports to retrieve content — bodies run 10–100KBsections: ["body"] pulls the body back on its ownnot_found when the ID doesn't existreliefweb_search_disasters <sub>tool</sub>date_from/date_to) — a bare 2024-01-15 works alongside full ISO 8601alert, ongoing, past, alert-archive; comma-separate for multiple, matched ignoring case, spacing, and punctuationalert-archive is reachable only with include_archived=true — the default preset hides itoffset/limit, up to 1,000 per call (default 10)reliefweb_get_disaster and as the disaster_id filter in reliefweb_search_reportsreliefweb_get_disaster <sub>tool</sub>keyContent, appealsResponsePlans, usefulLinks — each returns only its currently-active entries; archived entries page via archive: { list: <name> }sections: ["description"] or ["profileOverview"] pulls one narrative at a timesections and archive are alternative modes — a call supplying both is rejectednot_found when the ID doesn't existreliefweb_get_country <sub>tool</sub>keyContent, appealsResponsePlans, usefulLinks — each returns only its currently-active entries; archived entries (thousands deep for a long-running crisis) page via archive: { list: <name> }sections and archive are alternative modes — a call supplying both is rejectedreliefweb_list_countries to discover valid ISO3 codesnot_found for an unknown ISO3 codereliefweb_list_countries <sub>tool</sub>crisis_only=true to limit to active humanitarian situations (status ongoing)reliefweb_get_countryreliefweb_search_jobs <sub>tool</sub>include_archived=true reaches the closed archive, far larger than the open setdate.created:desc, default) or soonest closing (date.closing:asc)offset/limit, up to 1,000 per call (default 10)reliefweb_get_jobreliefweb_get_job <sub>tool</sub>sections: ["howToApply"] pulls the instructions without the whole descriptionnot_found pointing back at reliefweb_search_jobsreliefweb_search_training <sub>tool</sub>on-site or online), career category, and cost (free or fee-based)language filters the listing language; training_language filters delivery language. Summaries include cost and delivery languages when supplied by the organizerdate_start_from/date_start_to) — a bare 2024-06-01 works alongside full ISO 8601include_archived=true reaches concluded listings and drops the start-from-now default, so an otherwise unbounded search reaches the whole recorddate.start:asc, distinct from report date fields); override with sortreliefweb_get_trainingreliefweb_get_training <sub>tool</sub>sections: ["cost", "feeInformation", "howToRegister"] pulls just the practicalitiesnot_found pointing back at reliefweb_search_trainingreliefweb_list_sources <sub>tool</sub>type: Government, International Organization, Non-governmental Organization, Academic and Research Institution, Media, Red Cross/Red Crescent Movement, Otheroffset/limit, up to 1,000 per call (default 10)shortname with the source filter in reliefweb_search_reports, reliefweb_search_jobs, and reliefweb_search_trainingreliefweb://reports/{id} <sub>resource</sub>application/json — metadata, body text, and file URLsid must be digits only, exactly as search returned itreliefweb_get_report for an oversized reportreliefweb://disasters/{id} <sub>resource</sub>application/json — type, status, GLIDE, description, and curated content linksid must be digits only, exactly as search returned itreliefweb_get_disaster for an oversized disaster or to page an archivereliefweb://countries/{iso3} <sub>resource</sub>application/json — overview, situation summary, and active response plansreliefweb_get_countryiso3 must be a 3-letter ISO 3166-1 alpha-3 codereliefweb_crisis_briefing <sub>prompt</sub>country_or_disaster required (name, ISO3 code, or GLIDE number); focus optional — situation, jobs, or full (default)reliefweb-guide <sub>skill</sub>The bundled guide covers country/disaster research, opportunity evaluation, and checks before claiming that historical material is absent. MCP clients can discover and read it as a skill resource.
Built on @cyanheads/mcp-ts-core: stdio and Streamable HTTP transports, pluggable auth (none / jwt / oauth), swappable storage (in-memory, filesystem, Supabase, Cloudflare KV/R2/D1), structured logging with optional OpenTelemetry tracing.
ReliefWeb-specific:
format, disaster status, and training cost normalizes case, spacing, and punctuation instead of requiring exact ReliefWeb spelling24:00 resolves to the next midnightRELIEFWEB_APP_NAME validated at startup — required by the API since November 2025Agent-friendly output:
reliefweb_get_* tool to control context budgetnot_found error contracts and empty-result notices that echo applied filters and suggest how to broadenConnect to the public hosted server with Claude Code:
claude mcp add --transport http reliefweb-mcp-server https://reliefweb.caseyjhand.com/mcpOr run locally with your own pre-approved ReliefWeb appname:
claude mcp add reliefweb-mcp-server -e RELIEFWEB_APP_NAME=your-app-name -- npx -y @cyanheads/reliefweb-mcp-serverFor other MCP clients, add this to your MCP client configuration file:
{
"mcpServers": {
"reliefweb-mcp-server": {
"command": "npx",
"args": ["-y", "@cyanheads/reliefweb-mcp-server"],
"env": {
"RELIEFWEB_APP_NAME": "your-app-name"
}
}
}
}Register an appname at ReliefWeb API. For Docker or a source build, see Running the server.
| Variable | Description | Default |
|---|---|---|
RELIEFWEB_APP_NAME | Required. Pre-approved appname for the ReliefWeb API v2. Register at reliefweb.int/help/api. | — |
RELIEFWEB_CLAMP_LIMITS | Clamp over-cap page limits with an explicit notice. false restores strict schema maxima. | true |
MCP_TRANSPORT_TYPE | Transport: stdio or http | stdio |
MCP_HTTP_PORT | HTTP server port | 3010 |
MCP_HTTP_ENDPOINT_PATH | HTTP endpoint path where the MCP server is mounted | /mcp |
MCP_PUBLIC_URL | Public origin override for TLS-terminating reverse-proxy deployments | none |
MCP_AUTH_MODE | Authentication: none, jwt, or oauth | none |
MCP_SESSION_MODE | HTTP session handling: stateless, stateful, or auto (which resolves to stateful). The server declares stateless in src/index.ts — no handler needs a session — so set this only to override. | stateless |
MCP_LOG_LEVEL | Log level (debug, info, warning, error, etc.) | info |
MCP_GC_PRESSURE_INTERVAL_MS | Opt-in Bun-only forced-GC pressure loop (ms). Try 60000 if heap growth is observed under sustained HTTP load. | 0 (disabled) |
LOGS_DIR | Directory for log files (Node.js only). | <project-root>/logs |
STORAGE_PROVIDER_TYPE | Storage backend: in-memory, filesystem, supabase, cloudflare-kv/r2/d1 | in-memory |
OTEL_ENABLED | Enable OpenTelemetry | false |
See .env.example for the full list of optional overrides.
Requires Bun v1.4.0 or higher (or Node.js v24+ for the built server).
git clone https://github.com/cyanheads/reliefweb-mcp-server.git
cd reliefweb-mcp-server && bun install
cp .env.example .env # set RELIEFWEB_APP_NAME # One-time build
bun run rebuild
# Run the built server
bun run start:http
# or
bun run start:stdio bun run devcheck # Lints, formats, type-checks, and more
bun run test # Runs the test suitedocker run --rm -e RELIEFWEB_APP_NAME=your-app-name -p 3010:3010 ghcr.io/cyanheads/reliefweb-mcp-server:latestThe image defaults to HTTP transport, stateless session mode, and logs to /var/log/reliefweb-mcp-server. For stdio, use docker run -i --rm -e MCP_TRANSPORT_TYPE=stdio -e RELIEFWEB_APP_NAME=your-app-name ghcr.io/cyanheads/reliefweb-mcp-server:latest. Build locally with docker build -t reliefweb-mcp-server .; OpenTelemetry peers are installed by default — add --build-arg OTEL_ENABLED=false to omit them.
| Directory | Purpose |
|---|---|
src/mcp-server/tools | Tool definitions (*.tool.ts). Eleven tools across reports, disasters, countries, jobs, training, and sources, plus the shared pagination, section-outline, and profile-archive helpers. |
src/mcp-server/resources | Resource definitions. Report, disaster, and country resources. |
src/mcp-server/prompts | Prompt definitions. Crisis briefing prompt. |
src/services/reliefweb | ReliefWeb API service layer — HTTP client, filter builder, and response normalizers for all six content types. |
src/config | Server-specific environment variable parsing and validation with Zod. |
skills/ | Published agent guidance, also served as MCP skill resources. |
tests/ | Unit and integration tests, mirroring the src/ structure. |
See CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for logging, ctx.state for storagecreateApp() arraysIssues are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.