.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/wsdot-mcp-server</h1> <p><b>Query WA highway conditions, ferry schedules, vessel locations, toll rates, border waits, and alerts via MCP. STDIO or Streamable HTTP.</b> <div>12 Tools • 1 Skill Resource</div> </p> </div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://wsdot.caseyjhand.com/mcp
</div>
Washington State roads and ferries from WSDOT. Check mountain passes, travel times, tolls, border waits, alerts, and traffic cameras, and track ferry schedules, vessel locations, and terminal space.
| Tool | Description |
|---|---|
wsdot_get_mountain_passes | Current conditions for all WA mountain passes: status, road condition, traction laws, temperature, elevation. |
wsdot_search_alerts | Active highway alerts — incidents, construction, closures — filterable by state route, WSDOT region, and milepost range. |
wsdot_get_travel_times | Current vs. average travel times for named WA highway corridors (I-5, I-90, SR 520, etc.) with congestion delay. |
wsdot_get_toll_rates | Dynamic toll rates for WA express lanes and tolled facilities — SR 99, SR 167 HOT, I-405 Express, SR 509, SR 520 — filterable by route. |
wsdot_get_border_waits | Current vehicle wait times at all WA/Canada land border crossings. |
wsdot_search_cameras | Highway camera metadata and image URLs, filterable by state route, region, milepost range, and title words. |
wsdot_get_ferry_terminals | All WSF ferry terminals with numeric IDs needed for schedule and space lookups, plus coordinates. |
wsdot_get_ferry_routes | WSF routes operating on a given date — route ID, abbreviation, description, and the terminal pairs each serves, for route discovery, schedule lookups, and ferry-alert cross-reference. |
wsdot_get_ferry_schedule | Departure times for a specific WSF route — today-remaining or full-day future mode — with each sailing's vessel, loading rule, and notes. |
wsdot_get_vessel_locations | Real-time AIS positions, speed, heading, ETA, and dock status for all active WSF vessels. |
wsdot_get_terminal_space | Drive-up and reservable vehicle space available at WSF terminals for upcoming sailings. |
wsdot_get_ferry_alerts | Active WSF service disruptions and bulletins with impacted route IDs. |
| Resource | Description |
|---|---|
skill://wsdot-guide/SKILL.md | Ferry trip guidance for combining schedules, alerts, space, and vessel positions. |
skill://wsdot-guide/SKILL.md <sub>resource</sub>wsdot-guide.wsdot_get_mountain_passes <sub>tool</sub>wsdot_search_alerts <sub>tool</sub>stateRoute, region (Northwest, Olympic, Southwest, South Central, North Central, Eastern), and startMilepost / endMilepost — an alert matches when its extent overlaps the range; omit all for every statewide alert. Ordered by alertId, paged (default 20, max 500)invalid_region and a start above the end as invalid_milepost_range, each with a recovery hintwsdot_get_travel_times <sub>tool</sub>route — a route ("I-5", "SR 520") returns every corridor measured on it, any other text matches corridor names ("Everett"); paged (default 50, max 500)wsdot_get_toll_rates <sub>tool</sub>stateRoute matches the posted designation ("I-405", "SR 520"); a route with no tolled facility returns an empty page whose notice names the tolled routes. Paged (default 50, max 500)startLocationName → endLocationName segment. stateRoute is the feed's bare zero-padded number ("099") and travelDirection the feed's code, which SR 99, SR 509, and SR 520 fix per facility — read direction from the segment's endswsdot_get_border_waits <sub>tool</sub>crossings[] across I-5 (Peace Arch), SR 543 (Pacific Highway), SR 539 (Lynden), and SR 9 (Sumas): a general-purpose and a Nexus lane at each, plus truck lanes at SR 539 and SR 543crossingName is a route code (I5, SR543Trucks) and location.description the readable name; a lane with no current data omits waitTimeInMinuteswsdot_search_cameras <sub>tool</sub>stateRoute, region code (NW, SW, OL, ER, SC, NC, OS for the Oregon TripCheck cameras, WA for airport cameras), startMilepost / endMilepost, and titleContains (every word, any order). Ordered by cameraId, paged (default 50, max 500)invalid_region and a reversed range as invalid_milepost_rangewsdot_get_ferry_terminals <sub>tool</sub>wsdot_get_ferry_schedule and wsdot_get_terminal_space takewsdot_get_ferry_routes <sub>tool</sub>tripDate (YYYY-MM-DD, default today); a date outside the range WSF has published fails as invalid_date stating that rangeimpactedRouteIds of wsdot_get_ferry_alerts), abbreviation, description, and terminalPairs — the departing → arriving pairs wsdot_get_ferry_schedule accepts that daywsdot_get_ferry_schedule <sub>tool</sub>departingTerminalId and arrivingTerminalId (a pair from terminalPairs on wsdot_get_ferry_routes); optional tripDate (default today) and remainingOnly (future departures only, today only)departureTime / arrivalTime in ISO 8601 UTC (tripDate is the Pacific service day), vesselId, loadingRule, and indexes into the pair's annotations. There is no cancellation flag — WSF drops a cancelled sailing, so check wsdot_get_ferry_alertsinvalid_terminal_pair and a date with none as invalid_date, never as an empty schedulewsdot_get_vessel_locations <sub>tool</sub>opRouteAbbrev as none reportedwsdot_get_terminal_space <sub>tool</sub>departingTerminalId (from wsdot_get_ferry_terminals), else every terminal; paged by terminal (default 5, max 20), with every sailing of a returned terminal includeddriveUpSpaceCount is the key field — zero means the drive-up lane is full, and an oversubscribed sailing's negative upstream count floors to zero. arrivingTerminalIds chains into wsdot_get_ferry_schedulewsdot_get_ferry_alerts <sub>tool</sub>alertTitle, a one-line alertDescription, and the full bulletinText (detail such as a replacement sailing appears only in the body)impactedRouteIds map to wsdot_get_ferry_routes; affectsAllRoutes: true marks a fleet-wide alert, whose empty route list then means every routeBuilt on @cyanheads/mcp-ts-core: stdio and Streamable HTTP transports, pluggable auth (none / jwt / oauth), swappable storage (in-memory, filesystem, Supabase, Cloudflare KV/R2/D1), structured logging with optional OpenTelemetry tracing.
WSDOT-specific:
WSDOT_ACCESS_CODEwsdot_get_ferry_terminals / wsdot_get_ferry_routes for ID resolution before a lookupoffset / limit, and a page also ends early at a 24,000-byte response budget, with the notice naming the next offset"I-90", "90", "090", "SR 520" — and every text filter accepts at most 200 charactersAgent-friendly output:
invalid_access_code and api_unavailable errors carry an explicit recovery hint distinguishing configuration faults from transient upstream onesdriveUpSpaceCount: 0 and congestion delta fields (delayInMinutes) give agents actionable signal without string parsinglink text (url)null/undefined rather than synthetic defaults (e.g. an omitted waitTimeInMinutes, an absent arrivalTime)content[] and structuredContent carry the same values, not just the same fields — a false flag, an empty list, and one populated half of a coordinate pair all render rather than dropping out of the markdown surface that some clients read; a blank or whitespace-only upstream string is absent from both, and a populated one arrives trimmedConnect to the hosted instance, no install:
claude mcp add --transport http wsdot-mcp-server https://wsdot.caseyjhand.com/mcpOr run it locally:
claude mcp add wsdot-mcp-server -e WSDOT_ACCESS_CODE=your-access-code -- npx -y @cyanheads/wsdot-mcp-serverFor other clients, add this to the MCP config file:
{
"mcpServers": {
"wsdot-mcp-server": {
"command": "npx",
"args": ["-y", "@cyanheads/wsdot-mcp-server"],
"env": {
"WSDOT_ACCESS_CODE": "your-access-code"
}
}
}
}Get a free access code at wsdot.wa.gov/Traffic/api/. For Docker or a source build, see Running the server.
All configuration is validated at startup via Zod schemas in src/config/server-config.ts. Key environment variables:
| Variable | Description | Default |
|---|---|---|
WSDOT_ACCESS_CODE | Required. WSDOT Traveler API access code. Register at wsdot.wa.gov/Traffic/api/. | — |
MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio |
MCP_HTTP_PORT | HTTP server port. | 3010 |
MCP_HTTP_HOST | HTTP server hostname. | 127.0.0.1 |
MCP_HTTP_ENDPOINT_PATH | HTTP endpoint path. | /mcp |
MCP_PUBLIC_URL | Public origin for TLS-terminating reverse-proxy deployments. | — |
MCP_SESSION_MODE | Session handling: auto, stateful, or stateless. The schema default auto resolves to stateful; this server sets stateless explicitly. | stateless |
MCP_AUTH_MODE | Authentication: none, jwt, or oauth. | none |
MCP_LOG_LEVEL | Log level (debug, info, notice, warning, error). | info |
LOGS_DIR | Directory for log files (Node.js only). | <project-root>/logs |
STORAGE_PROVIDER_TYPE | Storage backend: in-memory, filesystem, supabase, cloudflare-kv/r2/d1. | in-memory |
LOG_TOOL_FAILURE_PAYLOADS | Log each failed tool call's arguments and result (key-name redaction only). | false |
OTEL_ENABLED | Enable OpenTelemetry instrumentation (spans, metrics, completion logs). | false |
OTEL_EXPORTER_OTLP_ENDPOINT | OTLP base URL; traces go to /v1/traces, metrics to /v1/metrics. | — |
OTEL_EXPORTER_OTLP_LOGS_ENDPOINT | Opt-in OTLP log export; the base endpoint never enables it. | — |
See .env.example for the full list of optional overrides.
Requires Bun v1.4.0 or higher (or Node.js v24+).
git clone https://github.com/cyanheads/wsdot-mcp-server.git
cd wsdot-mcp-server && bun install
cp .env.example .env # set WSDOT_ACCESS_CODE # One-time build
bun run rebuild
# Run the built server
bun run start:stdio
# or
bun run start:http bun run devcheck # Lint, format, typecheck, security
bun run test # Vitest test suite
bun run lint:mcp # Validate MCP definitions against specdocker run --rm -e WSDOT_ACCESS_CODE=your-access-code -p 3010:3010 ghcr.io/cyanheads/wsdot-mcp-server:latestThe image defaults to HTTP transport, stateless session mode, and logs to /var/log/wsdot-mcp-server. For stdio, use docker run -i --rm -e MCP_TRANSPORT_TYPE=stdio -e WSDOT_ACCESS_CODE=your-access-code ghcr.io/cyanheads/wsdot-mcp-server:latest. To build locally, run docker build -t wsdot-mcp-server .; OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them.
| Directory | Purpose |
|---|---|
src/index.ts | createApp() entry point — registers all 12 tools and initializes services. |
src/config | Server-specific environment variable parsing and validation with Zod. |
src/mcp-server/tools | Tool definitions (*.tool.ts) — 6 traffic tools, 6 ferry tools. |
src/services/traffic | WSDOT Traffic API service (mountain passes, alerts, travel times, toll rates, border waits, cameras). |
src/services/ferry | WSF Ferry API service (terminals, routes, schedule, vessel locations, space, alerts). |
skills/ | Published ferry trip guide, also served as an MCP skill resource. |
tests/ | Unit and integration tests, mirroring the src/ structure. |
See CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for request-scoped logging, ctx.state for tenant-scoped storagecreateApp() arrays in src/index.tsIssues are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.