io.github.cyanheads/fema-mcp-server

Est-ce que io.github.cyanheads/fema-mcp-server est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.cyanheads/fema-mcp-server » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 8 outils

• fema_dataframe_describe≈ 910 tokens

  List tables and column schemas on a DataCanvas staged by fema_search_nfip. Call this before fema_dataframe_query to discover the exact table name, column names, and DuckDB data types needed to write valid SQL. Row count reflects what was actually staged — check truncated in the fema_search_nfip response to know whether the canvas holds the full matching set.

  Paramètres, retour & exemple (1)

  Paramètres

  • canvas_id · string · requis
    Canvas ID from the fema_search_nfip response.

  Exemple d'appel

  {"name": "fema_dataframe_describe", "arguments": {"canvas_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"error": {}, "tables": [], "canvas_id": "texte"}}

• fema_dataframe_query≈ 1391 tokens

  Run a read-only SQL SELECT against a DataCanvas table staged by fema_search_nfip. Enables aggregation, GROUP BY, SUM/COUNT, time-series, and filtered analysis over the full NFIP claims result without re-fetching from the API. Call fema_dataframe_describe first to get the exact table name and column names needed for valid SQL. Only SELECT statements are allowed — DDL, DML, COPY, and file-reading functions are blocked. A response holds at most 100,000 characters of rows; when it holds fewer rows than the query returned, truncated and shown are set and the notice says how to page with OFFSET.

  Paramètres, retour & exemple (2)

  Paramètres

  • query · string · requis
    SQL SELECT statement to run against the staged table. Use the table name from fema_dataframe_describe. Results are capped at the canvas row limit and at 100,000 characters of rows; append LIMIT/OFFSET, under an ORDER BY, to page through additional rows, or aggregate (GROUP BY, COUNT, SUM) to summarize the full set in one query. Example: "SELECT year_of_loss, COUNT(*) AS claims, SUM(amount_paid_building) AS total_building_paid FROM df_nfip_abc123 GROUP BY year_of_loss ORDER BY year_of_loss"
  • canvas_id · string · requis
    Canvas ID from the fema_search_nfip response (the canvas_id field).

  Exemple d'appel

  {"name": "fema_dataframe_query", "arguments": {"query": "texte", "canvas_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"cap": 1, "rows": [], "error": {}, "shown": 1, "notice": "texte", "canvas_id": "texte", "row_count": 1, "truncated": true}}

• fema_get_disaster≈ 1238 tokens

  Fetch up to 1,000 designated-area rows for a specific FEMA disaster by disaster number (e.g., 4781). Discloses partial area and program coverage when more rows exist. Returns counties/municipalities along with programs observed, incident period, and state info. Use fema_search_disasters to find disaster numbers. The returned disaster_number chains to fema_get_public_assistance and fema_get_housing_assistance.

  Paramètres, retour & exemple (1)

  Paramètres

  • disaster_number · integer · requis
    FEMA disaster number (e.g., 4781). Obtain from fema_search_disasters.

  Exemple d'appel

  {"name": "fema_get_disaster", "arguments": {"disaster_number": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"error": {}, "state": "texte", "title": "texte", "notice": "texte", "hm_declared": true, "ia_declared": true, "pa_declared": true, "incident_type": "texte", "areas_truncated": true, "disaster_number": 1, "declaration_date": "texte", "declaration_type": "texte"}}

• fema_get_housing_assistance≈ 3000 tokens

  Retrieve Individual Assistance (IA) housing data for a disaster by disaster number. Returns owner and/or renter records aggregated by county, city, and ZIP code — valid registrations, total approved IHP amounts, repair/rental/other-needs amounts, and inspection counts (owners also carry inspected damage in USD). Narrow with state, county, or zip_code; owners_count, renters_count, and offset then count the filtered records. Use type to select owners, renters, or both (default). A page holds at most 100,000 characters of records, owners and renters cut at the same row count so one offset continues both; when records remain past it, next_offset is the offset to continue from. Use disaster_number from fema_search_disasters.

  Paramètres, retour & exemple (7)

  Paramètres

  • type · string · optionnel · owners | renters | both
    Which housing assistance dataset to query: owners, renters, or both (default).
  • limit · integer · optionnel
    Maximum records per dataset to return (1–10000, default 100). A page also stops at 100,000 characters of owner and renter records together, cutting both datasets at the same row count; when either bound leaves matching records out, next_offset names the offset to continue from.
  • state · string · optionnel
    Two-letter state code to narrow results when a disaster spans multiple states.
  • county · string · optionnel
    Filter by county name (e.g., Harris, dekalb). Case-insensitive substring match: harris also matches Harrison. OpenFEMA stores the county with its type, such as Harris (County) or Evangeline (Parish), and as the applicant reported it.
  • offset · integer · optionnel
    Pagination offset into each queried dataset (default 0). Pass the previous page’s next_offset to continue both.
  • zip_code · ? · optionnel
    Filter by 5-digit ZIP code, as a string with leading zeros kept (e.g., 77084, 00609). ZIP+4 is not accepted. One ZIP can return several records, one per county and city spelling.
  • disaster_number · integer · requis
    FEMA disaster number. Obtain from fema_search_disasters. Numbers above 32767 match no declaration.

  Exemple d'appel

  {"name": "fema_get_housing_assistance", "arguments": {"disaster_number": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"error": {}, "notice": "texte", "owners": [], "renters": [], "totalCount": 1, "next_offset": 1, "owners_count": 1, "county_filter": "texte", "renters_count": 1, "zip_code_filter": "texte"}}

• fema_get_public_assistance≈ 1765 tokens

  Retrieve Public Assistance (PA) funded project records for a disaster or state — shows where federal recovery money was obligated. Returns applicant, damage category, project size and status, federal share obligated, and total obligated amounts. Either disaster_number or state must be provided. Use disaster_number (from fema_search_disasters) to scope to a single declaration, or state to browse all PA projects for a state. PA projects are created only when the PA program is declared (pa_declared: true on the disaster). A page holds at most 100,000 characters of projects; when projects remain past it, next_offset is the offset to continue from.

  Paramètres, retour & exemple (5)

  Paramètres

  • limit · integer · optionnel
    Maximum number of projects to return (1–10000, default 100). A page also stops at 100,000 characters of projects (roughly 220 projects); when either bound leaves matching projects out, next_offset names the offset to continue from.
  • state · string · optionnel
    Two-letter state code to browse all PA projects for a state.
  • county · string · optionnel
    Filter by county name (e.g., Harris, dekalb). Case-insensitive substring match: harris also matches Harrison.
  • offset · integer · optionnel
    Pagination offset (default 0). Pass the previous page’s next_offset to continue.
  • disaster_number · integer · optionnel
    FEMA disaster number to scope results to a single declaration. Numbers above 32767 match no declaration.

  Exemple d'appel

  {"name": "fema_get_public_assistance", "arguments": {"limit": 1, "state": "texte", "county": "texte", "offset": 1, "disaster_number": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"error": {}, "notice": "texte", "projects": [], "totalCount": 1, "next_offset": 1, "total_count": 1, "returned_count": 1}}

• fema_query_dataset≈ 1568 tokens

  Generic OData query against any dataset in the OpenFEMA dataset catalog — the escape hatch for datasets the convenience tools do not cover (e.g., NfipPolicies, IndividualAssistanceHousingRegistrantsLargeDisasters, FemaWebDeclarationAreas, PublicAssistanceApplicants). Accepts raw OData filter, select, orderby, and pagination parameters. For NfipPolicies, use propertyState (not state) for the state and reportedZipCode for the ZIP code — it has no countyCode; always include a ZIP filter to avoid timeout. The dataset name must match the exact OpenFEMA entity name (case-sensitive, e.g., NfipClaims). Names missing from the catalog return an unknown_dataset error; a listed dataset OpenFEMA does not serve through the API, or a retired version, returns dataset_not_served. A page holds at most 100,000 characters of records; when records remain past it, next_offset is the offset to continue from.

  Paramètres, retour & exemple (6)

  Paramètres

  • limit · integer · optionnel
    Maximum records to return (1–10000, default 100). A page also stops at 100,000 characters of records; when either bound leaves matching records out, next_offset names the offset to continue from.
  • filter · string · optionnel
    OData $filter expression (e.g., "state eq 'TX' and declarationDate ge '2024-01-01T00:00:00.000Z'"). String values in single quotes. For a list of values use field in ('a','b'): OpenFEMA rejects filters nested more than 100 levels deep (about 90 chained and/or comparisons) and request URLs past about 8,900 characters.
  • offset · integer · optionnel
    Pagination offset (default 0). Pass the previous page’s next_offset to continue.
  • select · string · optionnel
    Comma-separated field names to return (e.g., "disasterNumber,state,declarationDate").
  • dataset · string · requis
    OpenFEMA dataset entity name (case-sensitive, e.g., NfipPolicies, FemaWebDeclarationAreas, PublicAssistanceApplicants).
  • orderby · string · optionnel
    OData $orderby expression (e.g., "declarationDate desc").

  Exemple d'appel

  {"name": "fema_query_dataset", "arguments": {"dataset": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"rows": [], "error": {}, "notice": "texte", "dataset": "texte", "totalCount": 1, "next_offset": 1, "total_count": 1, "returned_count": 1}}

• fema_search_disasters≈ 2957 tokens

  Search federal disaster declarations by state, incident type, declaration type, date range, and county. Returns deduplicated declaration-level summaries — each disaster number appears once with a designated_area_count showing how many counties/municipalities were designated. The disaster number is the chain key for fema_get_disaster, fema_get_public_assistance, and fema_get_housing_assistance. Use declaration_type to filter: DR (major disaster, most common), EM (emergency), FM (fire management). Date filters apply to the declaration date. Use fema_get_disaster to retrieve all designated-area rows for a specific declaration. county selects the declarations that designated a matching area; their area counts and program flags still describe the whole declaration, and matched_areas lists the matching areas with their own program flags. A search reads the most recent 10,000 designated-area rows; when more match, it returns the declarations dated after the day that window ends, sets truncated, and its notice names the date_to that continues with older declarations. A page holds at most 100,000 characters of declarations; when declarations remain past it, next_offset is the offset to continue from.

  Paramètres, retour & exemple (8)

  Paramètres

  • limit · integer · optionnel
    Maximum number of unique disaster declarations to return (1–1000, default 50). A page also stops at 100,000 characters of declarations (roughly 290 declarations, about 190 with county); when either bound leaves matching declarations out, next_offset names the offset to continue from.
  • state · string · optionnel
    Two-letter US state/territory code (e.g., TX, CA, FL, PR). Filters by state.
  • county · string · optionnel
    Filter by designated area / county name (e.g., Harris, Los Angeles, dekalb). Case-insensitive substring match: harris also matches Harrison. Selects the declarations that designated a matching area; designated_area_count and the program flags still describe the whole declaration, and matched_areas lists the matching areas.
  • offset · integer · optionnel
    Pagination offset in declarations (default 0). Pass the previous page’s next_offset to continue.
  • date_to · ? · optionnel
    End of the declaration date range as a calendar date in YYYY-MM-DD format (e.g., 2024-12-31). Inclusive; equal to date_from for a single day.
  • date_from · ? · optionnel
    Start of the declaration date range as a calendar date in YYYY-MM-DD format (e.g., 2024-01-01). Inclusive; not after date_to.
  • incident_type · string · optionnel
    Incident type filter (e.g., Flood, Hurricane, Tornado, Fire, Earthquake, Severe Storm). Case-insensitive substring match: storm also matches Snowstorm and Winter Storm.
  • declaration_type · string · optionnel · DR | EM | FM
    Declaration type: DR (major disaster declaration), EM (emergency declaration), FM (fire management assistance declaration).

  Exemple d'appel

  {"name": "fema_search_disasters", "arguments": {"limit": 1, "state": "texte", "county": "texte", "offset": 1, "date_to": "texte", "date_from": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"error": {}, "notice": "texte", "truncated": true, "totalCount": 1, "next_offset": 1, "declarations": [], "returned_count": 1, "total_area_rows": 1, "total_declarations": 1, "area_totals_unavailable": true}}

• fema_search_nfip≈ 2558 tokens

  Search National Flood Insurance Program (NFIP) claims data by state, county, ZIP code, and year range. Returns the matching claim count and claim records — amounts paid on building and contents, damage estimates, flood zones, cause and occupancy codes, and loss dates — newest loss first. state is required — the full NFIP dataset is 2.7 million rows; unfiltered access is prohibited. Page the inline claims with limit and offset; a page holds at most 100,000 characters of claims, and while claims remain past it, next_offset is the offset to continue from. When DataCanvas is enabled (CANVAS_PROVIDER_TYPE=duckdb) and the match exceeds that inline budget, a call at offset 0 stages the match (up to 50,000 claims) on a canvas: inspect the staged table with fema_dataframe_describe, then aggregate it with SQL via fema_dataframe_query.

  Paramètres, retour & exemple (8)

  Paramètres

  • limit · integer · optionnel
    Maximum claims to return inline (1–10000, default 1000). A page also stops at 100,000 characters of claims (roughly 330 claims); when either bound leaves matching claims out, next_offset names the offset to continue from. When DataCanvas is enabled and the match exceeds that character budget, a call at offset 0 stages the match on a canvas regardless of this value.
  • state · string · requis
    Two-letter US state code (required). NFIP dataset is 2.7M rows — state filter is mandatory.
  • offset · integer · optionnel
    Pagination offset into the matching claims, ordered newest date of loss first (default 0). Pass the previous page’s next_offset to continue. Only a call at offset 0 stages a match on a canvas; a later offset returns just its inline page. After a spill (spilled=true), read rows past the inline claims from the canvas table with fema_dataframe_query.
  • year_to · integer · optionnel
    End year of loss, inclusive (e.g., 2023). Equal to year_from for a single year.
  • zip_code · string · optionnel
    ZIP code to narrow results to a specific area (5-digit, e.g., 77002).
  • canvas_id · string · optionnel
    Optional canvas ID from a prior call, to stage this match as another table on that canvas. Used only when the match is staged; omit it to stage on a fresh canvas. Pass the returned canvas_id to fema_dataframe_describe for the table columns, then to fema_dataframe_query for SQL.
  • year_from · integer · optionnel
    Start year of loss, inclusive (e.g., 2020). Not after year_to.
  • county_code · string · optionnel
    County FIPS code to narrow results within the state: the full 5-digit state+county code (e.g., 48201 for Harris County TX), or the 3-digit county part (e.g., 201), to which the server prepends the state FIPS. A shorter county part is zero-padded to 3 digits (1 → 001), and a 4-digit code is zero-padded to 5 (1001 → 01001), the form a numeric 01001 arrives in. Any other value is rejected before the search runs.

  Exemple d'appel

  {"name": "fema_search_nfip", "arguments": {"state": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"error": {}, "claims": [], "notice": "texte", "spilled": true, "canvas_id": "texte", "truncated": true, "next_offset": 1, "total_count": 1, "canvas_table": "texte", "staged_count": 1, "returned_count": 1}}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://fema.caseyjhand.com/mcp