stackexchange-mcp-server-216ddf — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited stackexchange-mcp-server-216ddf (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/stackexchange-mcp-server</h1> <p><b>Search Stack Exchange questions, fetch complete Q&A threads as clean markdown, browse tag FAQs, and look up user profiles via MCP. STDIO or Streamable HTTP.</b> <div>5 Tools</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://stackexchange.caseyjhand.com/mcp
</div>
Stack Overflow and the rest of the Stack Exchange network, from Super User and Server Fault to Unix & Linux. Search questions, read complete Q&A threads as clean markdown, browse tag FAQs, and look up user profiles.
| Tool | Description |
|---|---|
stackexchange_search_questions | Search questions across a Stack Exchange site with full-text query, tag filters, score threshold, and sort order |
stackexchange_get_thread | Fetch a question and its answers as markdown, with a configurable answer limit and the accepted answer first |
stackexchange_get_tag_faq | Fetch the highest-voted answered questions for a tag — the canonical "best answers in X" list |
stackexchange_get_user | Fetch a user profile by ID: reputation, badge counts, top tags by answer score, and account metadata |
stackexchange_list_sites | Enumerate all Stack Exchange network sites and their api_site_parameter values |
stackexchange_search_questions <sub>tool</sub>page for more — each page costs one API quota unit, and paging past 25 requires STACKEXCHANGE_API_KEYstackexchange_get_threadstackexchange_get_thread <sub>tool</sub>maxAnswers answers (1–100, default 10), adding the accepted answer if it falls outside that pageincludeComments fetches up to 20 comments per post, newest first, using two extra API calls (one when there are no answers); commentsTruncated reports partial liststruncated when more answers exist upstream than maxAnswers returnedstackexchange_get_tag_faq <sub>tool</sub>/tags/{tag}/faq, the canonical "best answers in X" listpage for more — each page costs one API quota unit, and paging past 25 requires STACKEXCHANGE_API_KEYquestionId into stackexchange_get_thread for full contentstackexchange_get_user <sub>tool</sub>userId must be at most 2,147,483,647 (32-bit) — typically the authorUserId from stackexchange_get_thread outputuser_not_found error — Stack Exchange answers HTTP 200 with empty results rather than 404stackexchange_list_sites <sub>tool</sub>api_site_parameter, applied client-side after the fetchapi_site_parameter value (e.g. stackoverflow, superuser, serverfault) that every other tool's site parameter acceptsBuilt on @cyanheads/mcp-ts-core: stdio and Streamable HTTP transports, pluggable auth (none / jwt / oauth), swappable storage (in-memory, filesystem, Supabase, Cloudflare KV/R2/D1), structured logging with optional OpenTelemetry tracing.
Stack Exchange-specific:
quota_remaining and quota_max surfaced via enrichment on every tool callinvalid_site, invalid_parameter, invalid_api_key, invalid_id_or_url, invalid_user_id, question_not_found, user_not_found, paging_depth_limit, quota_exceeded, and upstream_unavailableSTACKEXCHANGE_API_KEY lifts the per-IP quota from ~300/day to ~10,000/day with no OAuth requiredAgent-friendly output:
not_found errors for missing questions and users (SE returns HTTP 200 with empty items[] rather than 404)A public instance is available at https://stackexchange.caseyjhand.com/mcp — no installation required. It serves Streamable HTTP; each client takes its own config shape.
For Claude Code:
claude mcp add --transport http stackexchange-mcp-server https://stackexchange.caseyjhand.com/mcpFor Cline (cline_mcp_settings.json):
{
"mcpServers": {
"stackexchange-mcp-server": {
"type": "streamableHttp",
"url": "https://stackexchange.caseyjhand.com/mcp"
}
}
}For Cursor (mcp.json):
{
"mcpServers": {
"stackexchange-mcp-server": {
"url": "https://stackexchange.caseyjhand.com/mcp"
}
}
}Claude Desktop adds remote servers under Settings → Connectors.
Add the following to your MCP client configuration file.
{
"mcpServers": {
"stackexchange": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/stackexchange-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"stackexchange": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/stackexchange-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with Docker:
{
"mcpServers": {
"stackexchange": {
"type": "stdio",
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "MCP_TRANSPORT_TYPE=stdio",
"ghcr.io/cyanheads/stackexchange-mcp-server:latest"
]
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http
# Server listens at http://localhost:3010/mcpRate limits: The Stack Exchange API allows ~300 requests/day per IP without a key. Set STACKEXCHANGE_API_KEY in env to lift this to ~10,000/day. Register a key at stackapps.com/apps/oauth/register (the OAuth flow is only required for write access — a key alone is sufficient for read-only use).
STACKEXCHANGE_API_KEY is optional but strongly recommended for any sustained usegit clone https://github.com/cyanheads/stackexchange-mcp-server.gitcd stackexchange-mcp-serverbun installcp .env.example .env
# edit .env and set STACKEXCHANGE_API_KEY if desired| Variable | Description | Default |
|---|---|---|
STACKEXCHANGE_API_KEY | Optional. Stack Exchange API key — lifts per-IP quota from ~300/day to ~10,000/day. | — |
MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio |
MCP_HTTP_PORT | Port for HTTP server. | 3010 |
MCP_HTTP_HOST | Host for HTTP server. | 127.0.0.1 |
MCP_SESSION_MODE | HTTP session mode: auto, stateful, or stateless. auto resolves to stateful. A meaningful env value overrides this server's stateless source default; blank or unsubstituted placeholders use the source default. | stateless |
MCP_AUTH_MODE | Auth mode: none, jwt, or oauth. | none |
MCP_LOG_LEVEL | Log level (RFC 5424). | info |
LOGS_DIR | Directory for log files (Node.js only). | <project-root>/logs |
LOG_TOOL_FAILURE_PAYLOADS | Log each failed tool call's arguments and result, redacted by key name and capped at LOG_TOOL_FAILURE_PAYLOAD_MAX_BYTES (default 16384). A secret inside a free-form value is not redacted. | false |
STORAGE_PROVIDER_TYPE | Storage backend. | in-memory |
OTEL_ENABLED | Enable OpenTelemetry instrumentation (spans, metrics, completion logs). | false |
OTEL_EXPORTER_OTLP_LOGS_ENDPOINT | Opt-in OTLP log export (e.g. http://localhost:4318/v1/logs); the base OTEL_EXPORTER_OTLP_ENDPOINT never enables it. | — |
See .env.example for the full list of optional overrides.
# One-time build
bun run rebuild
# Run the built server
bun run start:stdio
# or
bun run start:http bun run devcheck # Lint, format, typecheck, security
bun run test # Vitest test suite
bun run lint:mcp # Validate MCP definitions against specdocker build -t stackexchange-mcp-server .
docker run --rm -e STACKEXCHANGE_API_KEY=your-key -p 3010:3010 stackexchange-mcp-serverThe Dockerfile defaults to HTTP transport, stateless session mode, and logs to /var/log/stackexchange-mcp-server. OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them.
| Path | Purpose |
|---|---|
src/index.ts | createApp() entry point — registers tools and inits services. |
src/config/ | Server-specific environment variable parsing with Zod (STACKEXCHANGE_API_KEY). |
src/mcp-server/tools/ | Tool definitions (*.tool.ts). |
src/services/stackexchange/ | Stack Exchange API v2.3 HTTP client, backoff tracking, quota logging, HTML→markdown normalizer. |
tests/ | Vitest unit and integration tests. |
docs/ | Design document and directory tree. |
See CLAUDE.md/AGENTS.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for request-scoped logging, ctx.state for tenant-scoped storagesrc/mcp-server/tools/definitions/index.tsIssues are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.