io.github.cyanheads/faostat-mcp-server

Est-ce que io.github.cyanheads/faostat-mcp-server est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.cyanheads/faostat-mcp-server » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 6 outils

• faostat_commodity_profile≈ 3629 tokens

  Assemble a global profile for one QCL item in a single call: top-producing countries, the annual production trend, and trade flows (top exporters and importers). Supply item_code or item_query; code wins when both are supplied. A query selects a unique normalized exact label, otherwise a unique relevance match; ambiguous queries require an explicit code. Each ranking uses the selected item at each country's own latest year with data, grouped by unit. The trend is returned inline as year/value points. Country-level only (aggregates excluded). QCL is required; unavailable TCL yields a production-only profile with a notice. When the merged observation set is too large to inline, it spills to a DataCanvas table (canvas_id + table_name) — call faostat_dataframe_describe for its columns, then faostat_dataframe_query for deeper SQL.

  Paramètres, retour & exemple (6)

  Paramètres

  • top_n · integer · optionnel
    Number of top producers / exporters / importers to return. Max 50.
  • year_end · integer · optionnel
    Inclusive end year for the trend (e.g. 2022).
  • canvas_id · string · optionnel
    Canvas ID to stage onto, as returned by a prior faostat_query_observations / faostat_commodity_profile call — exactly 10 characters of letters, digits, hyphens, and underscores. Omit to stage onto this session’s canvas, created on the first spill and reused by every later call, so tables staged earlier in the session sit alongside this one.
  • item_code · integer · optionnel
    Exact item code present in QCL; takes precedence over item_query. Obtain it from faostat_resolve_codes with domain QCL and dimension item.
  • item_query · string · optionnel
    Commodity label or search term (e.g. "Wheat"). A unique normalized exact QCL label wins, otherwise the relevance search must match exactly one item. Broad queries such as "maize" or "milk" require item_code. Supply this or item_code.
  • year_start · integer · optionnel
    Inclusive start year for the trend (e.g. 1990).

  Exemple d'appel

  {"name": "faostat_commodity_profile", "arguments": {"top_n": 1, "year_end": 1, "canvas_id": "texte", "item_code": 1, "item_query": "texte", "year_start": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"error": {}, "notice": "texte", "spilled": true, "canvas_id": "texte", "truncated": true, "item_query": "texte", "table_name": "texte", "trend_points": 1, "top_exporters": [], "top_importers": [], "top_producers": [], "itemsTruncated": true}}

• faostat_dataframe_describe≈ 1447 tokens

  List the canvas tables (faostat_xxxxxxxx) staged by faostat_query_observations and faostat_commodity_profile, each with its source tool, the query parameters that produced it, creation/expiry timestamps, row count, and column schema. Call this before faostat_dataframe_query to discover the exact table and column names to reference in SQL. Tables are listed newest-first and paged: pass `name` to describe one table outright, or page with `offset` + `limit` — when the response reports `truncated`, pass the returned `nextOffset` to fetch the rest.

  Paramètres, retour & exemple (4)

  Paramètres

  • name · string · optionnel
    Optional table name (faostat_xxxxxxxx) to describe a single staged table. Takes precedence over `offset` / `limit`, which are ignored for a name lookup (always single-page).
  • limit · integer · optionnel
    Maximum staged tables to return on this page (max 100). Each entry carries a full column schema, so the default keeps a discovery call small.
  • offset · integer · optionnel
    Zero-based pagination offset into the staged tables (newest first). When the response reports truncated, pass the returned nextOffset here to fetch the next page. Ignored for `name` lookups.
  • canvas_id · string · optionnel
    Optional canvas ID as returned by a prior faostat_query_observations / faostat_commodity_profile call — exactly 10 characters of letters, digits, hyphens, and underscores. Omit to list the tables staged in this session (the common case).

  Exemple d'appel

  {"name": "faostat_dataframe_describe", "arguments": {"name": "texte", "limit": 1, "offset": 1, "canvas_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"error": {}, "notice": "texte", "tables": [], "truncated": true, "nextOffset": 1, "totalMatches": 1}}

• faostat_dataframe_query≈ 1206 tokens

  Run a single-statement SELECT against the canvas tables staged by faostat_query_observations and faostat_commodity_profile (table names look like faostat_xxxxxxxx). Use this for cross-country and cross-item aggregation, GROUP BY rankings, joins, and time-series analysis over the full result set the inline preview only sampled. Standard DuckDB SQL — joins, aggregates, window functions, CTEs all work. Read-only: writes, DDL, DROP, COPY, PRAGMA, ATTACH, and external-file table functions are rejected; system catalogs (information_schema, sqlite_master, duckdb_*) are denied — list staged tables via faostat_dataframe_describe. Every row carries its data-quality `flag` — commonly A=Official, B=time-series break, E=Estimated, I=Imputed, M=Missing (value cannot exist), T=Unofficial, X=from an international organization, plus others FAOSTAT defines per domain — keep it in projections, treat any unrecognized flag as informational, and never assume it is official.

  Paramètres, retour & exemple (3)

  Paramètres

  • sql · string · requis
    Single-statement read-only SELECT against staged faostat_<id> tables. Columns: area_code, area, item_code, item, element_code, element, year, unit, value, flag — plus domain (QCL or TCL) on tables staged by faostat_commodity_profile.
  • canvas_id · string · optionnel
    Optional canvas ID as returned by a prior faostat_query_observations / faostat_commodity_profile call — exactly 10 characters of letters, digits, hyphens, and underscores. Omit to query the tables staged in this session (the common case).
  • row_limit · integer · optionnel
    Hard cap on rows in the response. Default 1000, max 10000.

  Exemple d'appel

  {"name": "faostat_dataframe_query", "arguments": {"sql": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"rows": [], "error": {}, "notice": "texte", "columns": [], "row_count": 1, "truncated": true}}

• faostat_list_domains≈ 1443 tokens

  Discover FAOSTAT statistical domains (production, trade, food balances, food security, land use, agri-emissions, prices, value) with their codes, descriptions, last-update date, upstream row count, and local index status. Every query keys on a domain code from here. The `indexed` flag tells you which domains are queryable right now; un-indexed domains exist in the catalog but must be added to FAOSTAT_DOMAINS and re-synced before faostat_query_observations can read them. The catalog runs to ~69 domains with long descriptions, so responses are paged: narrow with `topic` / `indexed_only`, pass `code` to fetch one domain outright, or page with `offset` + `limit` — when the response reports `truncated`, pass the returned `nextOffset` to fetch the rest.

  Paramètres, retour & exemple (5)

  Paramètres

  • code · string · optionnel
    Exact domain code lookup (e.g. "RL"), case-insensitive. Returns that one domain's full record on a single page. Takes precedence over `topic` / `indexed_only` when provided.
  • limit · integer · optionnel
    Maximum domains to return on this page (max 200 — above the catalog size, so raise it to fetch everything at once). Domain descriptions are long; the default keeps a browse call small.
  • topic · string · optionnel
    Case-insensitive substring filter over domain code, name, and topic (e.g. "trade", "emissions", "QCL"). Omit to list the full catalog.
  • offset · integer · optionnel
    Zero-based pagination offset into the matching domains (code-sorted). When the response reports truncated, pass the returned nextOffset here to fetch the next page. Ignored for exact-code lookups (always single-page).
  • indexed_only · boolean · optionnel
    When true, return only domains indexed in the local mirror (queryable now).

  Exemple d'appel

  {"name": "faostat_list_domains", "arguments": {"code": "texte", "limit": 1, "topic": "texte", "offset": 1, "indexed_only": true}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"error": {}, "notice": "texte", "domains": [], "truncated": true, "nextOffset": 1, "totalCount": 1, "indexedCount": 1, "totalMatches": 1}}

• faostat_query_observations≈ 2216 tokens

  Query a FAOSTAT domain's data cube by area(s), item(s), element(s), and year range, returning observations (area, item, element, year, value, unit, and the data-quality flag). Resolve codes first with faostat_resolve_codes — the cube is unqueryable without them. Aggregate regions (World, continents, economic groupings) are EXCLUDED by default so a naive SUM does not double-count a region with its member countries; set include_aggregates=true to get the regional roll-ups, or pass explicit area_codes to query exactly what you name. Small result sets return inline; large ones spill to a DataCanvas table (returned canvas_id + table_name) — call faostat_dataframe_describe for its columns, then faostat_dataframe_query for GROUP BY / ranking / time-series analysis. Every row carries its flag — commonly A=Official, B=time-series break, E=Estimated, I=Imputed, M=Missing (value cannot exist), T=Unofficial, X=from an international organization, plus others FAOSTAT defines per domain — so honor it, treat any unrecognized flag as informational, and never assume an estimated, imputed, or unrecognized value is official.

  Paramètres, retour & exemple (9)

  Paramètres

  • limit · integer · optionnel
    Max observations returned inline — also the preview size when the result stages to a canvas table. Rows past it are never dropped silently: a match larger than limit stages in full to a DataCanvas table (canvas_id + table_name), and when no table is staged the notice reports how many matched so you can raise limit or narrow the filters. Max 1000.
  • domain · string · requis
    FAOSTAT domain code (e.g. "QCL"). Must be indexed locally.
  • year_end · integer · optionnel
    Inclusive end year (e.g. 2022).
  • canvas_id · string · optionnel
    Canvas ID to stage onto, as returned by a prior faostat_query_observations / faostat_commodity_profile call — exactly 10 characters of letters, digits, hyphens, and underscores. Omit to stage onto this session’s canvas, created on the first spill and reused by every later call, so tables staged earlier in the session sit alongside this one.
  • area_codes · array · optionnel
    Area codes from faostat_resolve_codes. When set, aggregates are NOT auto-excluded — the codes are honored verbatim.
  • item_codes · array · optionnel
    Item codes from faostat_resolve_codes.
  • year_start · integer · optionnel
    Inclusive start year (e.g. 2000).
  • element_codes · array · optionnel
    Element codes from faostat_resolve_codes (e.g. 5510 Production).
  • include_aggregates · boolean · optionnel
    When false (default), exclude aggregate-region rows (codes ≥ 5000 plus a few curated sub-threshold roll-ups such as China=351) so sums are not double-counted. Set true for World/continent/grouping roll-ups. Ignored when explicit area_codes are passed.

  Exemple d'appel

  {"name": "faostat_query_observations", "arguments": {"domain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"error": {}, "domain": "texte", "notice": "texte", "spilled": true, "canvas_id": "texte", "truncated": true, "table_name": "texte", "totalCount": 1, "observations": [], "staged_row_count": 1}}

• faostat_resolve_codes≈ 1516 tokens

  Resolve human terms to the opaque integer codes faostat_query_observations needs, within a dimension: areas (countries/regions), items (commodities), or elements (metrics like production, yield, import quantity). Pass `query` for fuzzy full-text matching ("maize" → item 56), `name_contains` for a substring filter, or `code` for an exact-code lookup; omit all three to list the whole dimension. Item and element results are scoped to the requested domain — only codes present in that domain's cube are returned, so a resolved code is always queryable there (areas are shared across domains). Page large listings with `offset` + `limit`: when the response reports `truncated`, pass the returned `nextOffset` to fetch the next page. Every area match is flagged `country` or `aggregate` — aggregates (World, continents, economic groupings — codes ≥ 5000 plus a few curated sub-threshold roll-ups such as China=351, which sums mainland + Taiwan + Hong Kong + Macao) double-count if summed with their member countries, so resolve before querying and exclude aggregates unless you want the regional roll-up.

  Paramètres, retour & exemple (7)

  Paramètres

  • code · integer · optionnel
    Exact code lookup. Takes precedence over `query`/`name_contains` when provided.
  • limit · integer · optionnel
    Maximum matches to return (max 200).
  • query · string · optionnel
    Full-text search term, FTS5-matched against the dimension labels with prefix matching (e.g. "wheat", "import quantity"). Relevance-ranked.
  • domain · string · requis
    FAOSTAT domain code (e.g. "QCL"). Item and element resolution is scoped to the codes present in this domain's data; area code lists are shared across all indexed domains.
  • offset · integer · optionnel
    Zero-based pagination offset into the match set. When the response reports truncated, pass the returned nextOffset here to fetch the next page. Ignored for exact-code lookups (always single-page).
  • dimension · string · requis · area | item | element
    Which dimension to resolve: "area" (countries/regions), "item" (commodities), or "element" (metrics).
  • name_contains · string · optionnel
    Case-insensitive substring filter over the label. Used only when `query` is omitted.

  Exemple d'appel

  {"name": "faostat_resolve_codes", "arguments": {"domain": "texte", "dimension": "area"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"error": {}, "domain": "texte", "notice": "texte", "matches": [], "dimension": "texte", "truncated": true, "nextOffset": 1, "totalMatches": 1}}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://faostat.caseyjhand.com/mcp