Qweather Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Qweather Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
English | 简体中文
MCP server for QWeather API, providing comprehensive weather information query capabilities through Model Context Protocol (MCP).
Recommended: Install automatically for Claude Desktop using Smithery:
npx -y @smithery/cli install @overstarry/qweather-mcp --client claude# stdio server
npx -y qweather-mcpQWeather has announced that API Key authentication will be deprecated in 2027 and recommends migrating to JWT (EdDSA + Ed25519). Generate an Ed25519 key pair, upload the public key to the QWeather console, and configure:
QWEATHER_API_BASE=https://<your-host>.qweatherapi.com
QWEATHER_PROJECT_ID=<project-id>
QWEATHER_KEY_ID=<credential-id>
# Either pass the PEM path…
QWEATHER_PRIVATE_KEY_PATH=/path/to/ed25519-private.pem
# …or the PEM content directly (newlines preserved)
# QWEATHER_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"If both QWEATHER_PRIVATE_KEY_PATH and QWEATHER_PRIVATE_KEY are provided, the path takes precedence. For QWEATHER_PRIVATE_KEY, the literal two-character sequence \n is auto-converted to real newlines, so the single-line form above works in shells, .env files, and JSON configs.
JSON config example:
{
"mcpServers": {
"qweather": {
"command": "npx",
"args": ["-y", "qweather-mcp"],
"env": {
"QWEATHER_API_BASE": "https://<your-host>.qweatherapi.com",
"QWEATHER_PROJECT_ID": "<project-id>",
"QWEATHER_KEY_ID": "<credential-id>",
"QWEATHER_PRIVATE_KEY_PATH": "/path/to/ed25519-private.pem"
}
}
}
}JWT details: tokens are signed with alg=EdDSA, iat is back-dated 30s to tolerate clock skew, exp = iat + 900s (15 min, well under QWeather's 24h cap), and tokens are cached and reused until ~30s before expiry. See the official authentication docs.
QWEATHER_API_BASE=https://api.qweather.com
QWEATHER_API_KEY=<your-api-key>JSON config example:
{
"mcpServers": {
"qweather": {
"command": "npx",
"args": ["-y", "qweather-mcp"],
"env": {
"QWEATHER_API_BASE": "<your-api-url>",
"QWEATHER_API_KEY": "<your-api-key>"
}
}
}
}| Env vars present | Mode |
|---|---|
Full JWT vars (QWEATHER_PROJECT_ID + QWEATHER_KEY_ID + QWEATHER_PRIVATE_KEY[_PATH]) | JWT (wins even if QWEATHER_API_KEY is also set) |
Full JWT vars + QWEATHER_API_KEY | JWT (API Key is ignored) |
Partial JWT vars + QWEATHER_API_KEY | API Key, with a startup warning to stderr |
| Partial JWT vars only | startup error |
QWEATHER_API_KEY only | API Key |
| neither | startup error |
The active mode is logged to stderr at startup, e.g. Weather MCP Server running on stdio (auth: JWT/EdDSA).
Get current weather information for a specified location.
Get weather forecast information for a specified location with customizable forecast days:
Forecast data includes:
Provides minute-by-minute precipitation forecast for the next 2 hours, including:
Provides hourly weather forecasts for 24, 72, or 168 hours, including:
Provides real-time weather warning information, including:
Provides weather life indices information, supporting various index types:
and 16 other life indices
Provides real-time air quality data, including:
Provides hourly air quality forecast for the next 24 hours:
Provides air quality forecast for the next 3 days:
Issues and improvements are welcome! Please check our contribution guidelines.
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.