Parknyc Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Parknyc Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for ParkNYC (Flowbird) -- manage your NYC parking sessions, vehicles, and zones from any MCP client (Claude Code, Claude Desktop, etc.).
Note: The Flowbird consumer API is undocumented. This server was built by reverse-engineering the ParkNYC web app JavaScript bundles. No public API docs exist.
git clone <repo-url> parknyc-mcp
cd parknyc-mcp
npm install
npm run buildThe API authenticates via browser cookies. You need three: PHPSESSID, server, and user.
Cmd+Option+I) and go to the Network tabcustomer/get and refresh the pagecustomer/get request server=.apachen2; PHPSESSID=abc123...; user=def456...Important: Do not include theg_statecookie if present -- it contains JSON braces that break the config file. You only needPHPSESSID,server, anduser.
#### Claude Code
Add a .mcp.json file to your project root:
{
"mcpServers": {
"parknyc": {
"command": "node",
"args": ["/path/to/parknyc-mcp/dist/index.js"],
"env": {
"PARKNYC_COOKIES": "server=.apachen2; PHPSESSID=your_session_id; user=your_user_cookie"
}
}
}
}#### Claude Desktop
Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS):
{
"mcpServers": {
"parknyc": {
"command": "node",
"args": ["/path/to/parknyc-mcp/dist/index.js"],
"env": {
"PARKNYC_COOKIES": "server=.apachen2; PHPSESSID=your_session_id; user=your_user_cookie"
}
}
}
}Cookies expire periodically. If you checked "Keep me logged in", they should last days to weeks. Without it, sessions expire in ~30 minutes. When you start getting 401 errors, repeat step 2 to get fresh cookies and update your config.
| Variable | Required | Description |
|---|---|---|
PARKNYC_COOKIES | Yes | Full cookie string from browser (must include PHPSESSID, server, user) |
PARKNYC_LANGUAGE | No | Language code for API responses (default: en) |
| Tool | Description |
|---|---|
get_account | Get your account profile (name, email, phone, address) |
get_active_sessions | Get currently active/ongoing parking sessions |
get_parking_history | Get past parking sessions with pagination |
get_order | Get details of a specific parking order by ID |
get_vehicles | List all registered vehicles |
search_zone | Search for a parking zone by number |
get_zone_info | Get zone details (facility ID or POS number) |
get_bookmarks | Get saved/favorite parking locations |
get_payment_accounts | Get payment methods on file (cards, e-wallet) |
| Tool | Description |
|---|---|
start_parking | Start a new parking session at a zone |
stop_parking | Stop an active parking session early |
extend_parking | Extend an active parking session |
cancel_parking | Cancel a parking order |
add_vehicle | Register a new vehicle |
delete_vehicle | Remove a vehicle from your account |
add_bookmark | Save a parking zone as a favorite |
delete_bookmark | Remove a saved favorite |
> Show my parking history from this week
> Do I have any active parking sessions?
> What vehicles are on my account?
> Search for zone 12345
> How much have I spent on parking this month?
> Start 15 minutes of parking at zone 12345 with my carThe Flowbird/ParkNYC web app at my.nyc.flowbirdapp.com is a PHP-backed Angular SPA. This MCP server mimics the browser's API calls:
PHPSESSID for PHP session, server for load balancer affinity, user for the auth identity token)X-MPP-Brand: parknyc on every requestplatform=nyc, version=2.0.21+1792, and rt=<timestamp> on every request/api/search/order/ with x-api-caller: customer headerorder/create (proposal) then order/confirm (payment)user cookie expire; you'll need to refresh them periodicallystart_parking tool needs the zone's usertype value which varies by zone. This is still being refined and may not work for all zonesMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.