.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/treasury-fiscaldata-mcp-server</h1> <p><b>Query US Treasury national debt, interest rates, exchange rates, and fiscal datasets via MCP. STDIO or Streamable HTTP.</b> <div>7 Tools</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://treasury-fiscaldata.caseyjhand.com/mcp
</div>
Five tools for querying the US Treasury Fiscal Data API, plus two for SQL analytics over DuckDB-backed DataCanvas dataframes:
| Tool | Description |
|---|---|
treasury_list_datasets | Browse the curated catalog of 17 Treasury Fiscal Data endpoints with field names, descriptions, and update cadence |
treasury_query_dataset | Query any Treasury Fiscal Data endpoint by path, field list, filters, sort, and page — with optional DataCanvas spill |
treasury_get_debt | Fetch national debt (Debt to the Penny) — latest record, specific date, or date-range series with optional DataCanvas spill |
treasury_get_interest_rates | Average interest rates Treasury pays on outstanding securities by type (Bills, Notes, Bonds, TIPS, FRN) |
treasury_get_exchange_rates | Official Treasury statutory exchange rates for ~130 countries, published quarterly |
treasury_dataframe_describe | List DataCanvas dataframes materialized by the treasury_* tools with schema, row count, and TTL |
treasury_dataframe_query | Run a single-statement SELECT against DataCanvas dataframes using standard DuckDB SQL |
treasury_list_datasetsBrowse the embedded catalog of available Treasury Fiscal Data endpoints. No network calls — serves from a static catalog bundled with the server.
debt, interest_rates, exchange_rates, revenue_spending, savings_bonds, securities, othertreasury_query_datasettreasury_query_datasetGeneric parameterized query against any Treasury Fiscal Data endpoint.
{ field, operator, value } where operator is eq, gt, gte, lt, lte, inpage_size (1–10000) and page_number- prefix (e.g. -record_date)"null" means no valuecanvas_id to register results into a named DataCanvas dataframe for SQL via treasury_dataframe_query (requires CANVAS_PROVIDER_TYPE=duckdb)treasury_get_debtConvenience tool for national debt (Debt to the Penny) — total public debt outstanding broken into publicly-held debt and intragovernmental holdings.
mode=latest — most recent business-day recordmode=date — specific business day (YYYY-MM-DD; API only records debt on market-open days)mode=series — date range, sorted newest-first; auto-spills to DataCanvas when the series exceeds 500 rowstreasury_get_interest_ratesAverage interest rates the Treasury pays on outstanding securities. Updated monthly (end-of-month records).
mode=latest — most recent month's rates for all or one security typemode=series — time-range history; auto-spills to DataCanvas when results exceed 200 rowstreasury_get_exchange_ratesOfficial Treasury statutory reporting exchange rates for ~130 countries, published quarterly (March 31, June 30, Sep 30, Dec 31).
mode=series auto-spills to DataCanvas when results exceed 500 rows (~18,800 rows full history)treasury_dataframe_describe / treasury_dataframe_queryIn-conversation SQL analytics over the dataframes that treasury_query_dataset, treasury_get_debt, treasury_get_interest_rates, and treasury_get_exchange_rates materialize on a shared DuckDB-backed DataCanvas. Each data-returning call with canvas_id adds a df_XXXXX_XXXXX handle; pass that handle to treasury_dataframe_query for joins, aggregates, window functions, and CTEs — standard DuckDB SQL.
information_schema, pg_catalog, sqlite_master, duckdb_*) are denied at the bridge layer.DECIMAL or DATE for arithmetic and date comparisons.treasury_dataframe_query can persist its result as a new dataframe with a fresh TTL for multi-step analysis.CANVAS_TTL_MS).CANVAS_PROVIDER_TYPE=duckdb.Built on @cyanheads/mcp-ts-core:
none, jwt, oauthTreasury-specific:
treasury_query_dataset to access datasets not in the catalog.treasury_query_datasetdf_<id> dataframes queryable via DuckDB SQLAgent-friendly output:
applied_filters) so agents can verify what was sent to the APIfield_labels) map raw field names to human-readable labelstreasury_dataframe_describeA public instance is available at https://treasury-fiscaldata.caseyjhand.com/mcp — no installation required. Point any MCP client at it via Streamable HTTP:
{
"mcpServers": {
"treasury-fiscaldata-mcp-server": {
"type": "streamable-http",
"url": "https://treasury-fiscaldata.caseyjhand.com/mcp"
}
}
}Add the following to your MCP client configuration file.
{
"mcpServers": {
"treasury-fiscaldata-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/treasury-fiscaldata-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"treasury-fiscaldata-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/treasury-fiscaldata-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with Docker:
{
"mcpServers": {
"treasury-fiscaldata-mcp-server": {
"type": "stdio",
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "MCP_TRANSPORT_TYPE=stdio",
"ghcr.io/cyanheads/treasury-fiscaldata-mcp-server:latest"
]
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http
# Server listens at http://localhost:3010/mcpFor large time-series pulls or multi-dataset analysis, use the DataCanvas SQL workflow:
treasury_get_debt with mode=series and a canvas_id value, or treasury_query_dataset with canvas_id. The tool registers the results as a df_XXXXX_XXXXX dataframe and returns the table name.treasury_dataframe_describe — lists column names, types (all VARCHAR for Treasury data), row count, and TTL.treasury_dataframe_query — standard DuckDB SELECT with joins, aggregates, window functions, and CTEs. CAST VARCHAR columns to DECIMAL or DATE for arithmetic.-- Example: debt trend over the last year, month-end records only
SELECT
record_date,
CAST(tot_pub_debt_out_amt AS DECIMAL) / 1e12 AS total_debt_trillions
FROM df_xxxxx
WHERE CAST(record_date AS DATE) >= CURRENT_DATE - INTERVAL 1 YEAR
ORDER BY record_date DESCCANVAS_PROVIDER_TYPE=duckdb (DuckDB is bundled as @duckdb/node-api).git clone https://github.com/cyanheads/treasury-fiscaldata-mcp-server.gitcd treasury-fiscaldata-mcp-serverbun installcp .env.example .env
# edit .env as needed — no required vars; CANVAS_PROVIDER_TYPE=duckdb to enable SQL| Variable | Description | Default |
|---|---|---|
CANVAS_PROVIDER_TYPE | Canvas engine. Set to duckdb to enable DataCanvas SQL via treasury_dataframe_* tools. Set to none to disable (e.g. on Cloudflare Workers). | duckdb |
CANVAS_TTL_MS | Per-table TTL for DataCanvas dataframes in milliseconds. | 86400000 (24h) |
MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio |
MCP_HTTP_PORT | Port for HTTP server. | 3010 |
MCP_AUTH_MODE | Auth mode: none, jwt, or oauth. | none |
MCP_LOG_LEVEL | Log level (debug, info, notice, warning, error). | info |
LOGS_DIR | Directory for log files (Node.js/Bun only). | <project-root>/logs |
OTEL_ENABLED | Enable OpenTelemetry spans and metrics. | false |
See .env.example for the full list of optional overrides.
bun run rebuild
bun run start:stdio
# or
bun run start:http bun run devcheck # Lint, format, typecheck, security
bun run test # Vitest test suite
bun run lint:mcp # Validate MCP definitions against specdocker build -t treasury-fiscaldata-mcp-server .
docker run --rm -e CANVAS_PROVIDER_TYPE=duckdb -p 3010:3010 treasury-fiscaldata-mcp-serverThe Dockerfile defaults to HTTP transport, stateless session mode, and logs to /var/log/treasury-fiscaldata-mcp-server. DuckDB native modules are pre-built in the build stage and copied to the production stage — no extra build tools required at runtime. OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them.
| Directory | Purpose |
|---|---|
src/index.ts | createApp() entry point — registers tools and inits services. |
src/config/ | Server-specific environment variable parsing and validation with Zod. |
src/mcp-server/tools/definitions/ | Tool definitions (*.tool.ts) — 5 data tools + 2 DataCanvas tools. |
src/services/fiscal-data/ | Treasury Fiscal Data API client, embedded endpoint catalog, and types. |
src/services/canvas-bridge/ | Adapter over the framework DataCanvas: df_<id> minting, per-table TTL, system-catalog SQL deny. |
tests/ | Unit and integration tests mirroring src/. |
See CLAUDE.md and AGENTS.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for request-scoped logging, ctx.state for tenant-scoped storagesrc/index.tsIssues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.