# Recall Canary (remote · recallcanary.com)

U.S. federal product recalls from FDA, FSIS, CPSC, and NHTSA, in one schema.

- Trust score: 75/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `recallcanary.com`: 75/100 (this document), [markdown](https://verifymcp.io/servers/com-recallcanary-recall-canary/data-mcp.md), [page](https://verifymcp.io/servers/com-recallcanary-recall-canary/data-mcp)

## Channel facts

- Endpoint: `https://recallcanary.com/data/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.4.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 83/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC is configured correctly; the domain's records validate against the full chain to the root.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 56/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1344 tokens (~672/item across 2 items; 2 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 2 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 3 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the Recall Canary MCP server?

Recall Canary is a hosted endpoint at https://recallcanary.com/data/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http com-recallcanary-recall-canary 'https://recallcanary.com/data/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "com-recallcanary-recall-canary": {
      "url": "https://recallcanary.com/data/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "com-recallcanary-recall-canary": {
      "type": "http",
      "url": "https://recallcanary.com/data/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.com-recallcanary-recall-canary]
url = "https://recallcanary.com/data/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-recallcanary-recall-canary": {
      "type": "remote",
      "url": "https://recallcanary.com/data/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-recallcanary-recall-canary --url 'https://recallcanary.com/data/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-recallcanary-recall-canary:
    url: "https://recallcanary.com/data/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "com-recallcanary-recall-canary": {
      "Transport": "http",
      "Url": "https://recallcanary.com/data/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add com-recallcanary-recall-canary -t streamable-http -u 'https://recallcanary.com/data/mcp'
```

### Other

```json
{
  "mcpServers": {
    "com-recallcanary-recall-canary": {
      "type": "http",
      "url": "https://recallcanary.com/data/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-03 (score 75, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-01 (score 74, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-30 (score 73, +1)

- [functional] Server version: 1.3.0 → 1.4.0

### 2026-10-28 (score 72, +1)

- [functional improvement] Stability: unverified → 0.03
- [functional] Server version: 1.2.0 → 1.3.0
- [cosmetic] “search_recalls” reworded the description of “q”

### 2026-10-27 (score 71)

First indexed and scored.

## MCP tools (2)

### `search_recalls` (~964 tokens)

Search U.S. federal product recalls

Search the Recall Canary index of U.S. federal product recalls (FDA, FSIS, CPSC, NHTSA) by keyword, agency, severity, category, distribution state, hazard, firm, or date window. Returns up to 50 matching records per page with abbreviated content (title, firm, severity, date, and the canonical URL of each); call get_recall to fetch the full record. With a keyword, the best matches come first unless `sort` says otherwise. Unknown agency, severity, category, state and date values are rejected with an error message describing the allowed values. An unknown `hazard` or `firm` is also an error. Read-only.

Input parameters:

- `agency` (array): Issuing agencies; matches any. Case-insensitive; values are uppercase.
- `category` (string): Single-select product category. Case-insensitive; values are uppercase.
- `date` (string): Relative window, resolved against the request clock. Ignored when `from` or `to` is set.
- `firm` (string): Firm slug: the firm of one recall, as the `firm.slug` value of a get_recall record, or the last part of a /firm/ page URL (for example "acme-foods"). Matches that firm's recalls and press releases. A…
- `from` (string): Inclusive lower bound, YYYY-MM-DD at 00:00:00 UTC.
- `hazard` (string): Single-select hazard tag, lowercase and hyphenated, the same filter as the website hazard pages: matches records whose hazard_tags include it, press releases included. Anything else is an error.
- `page` (integer): 1-based page number, 50 records per page. Values above 200 clamp to 200; reach deeper archive by narrowing the date window instead. Pass the next page number in this parameter to navigate paginated r…
- `q` (string): Free-text query over one index of canonical recalls and preliminary press releases: titles, firm, product name/brand/description, agency reason text, AI summary, hazard tags, and identifiers (UPC, ND…
- `severity` (array): Matches any. The issuing agency's own level (FDA/FSIS class, NHTSA do-not-drive or park-outside warning) on one scale by a fixed rule; null when the agency gave none. A record reporting null can stil…
- `sort` (string): `relevance` (the default when `q` is set) puts the best matches first. `recent` orders by listing date descending (the default without `q`). `severity` puts CRITICAL then MODERATE first, date descend…
- `state` (string): Two-letter USPS code for a U.S. state or DC. Matches records distributed there or flagged nationwide. Territories are not filterable. Note the round trip: this takes a bare code such as "TX", while `…
- `to` (string): Inclusive upper bound, YYYY-MM-DD at 23:59:59 UTC.

Output parameters:

- `api_version` (string)
- `canonical` (string): Absolute URL of this representation.
- `filters` (object): The filters as applied, after normalization. An unapplied filter is echoed as null or [].
- `html_url` (string): Absolute URL of the human-readable page.
- `license` (object): Attribution and terms (DATA-LICENSE).
- `notes` (string): The caveat that absence of a match is not a clearance.
- `notices` (array): Rules that narrowed or widened the results, stated in band. Empty when none apply.
- `pagination` (object)
- `relaxed` (boolean)
- `results` (array)
- `snapshot_at` (string): ISO-8601 UTC response-generation time, second precision. First key on purpose.

### `get_recall` (~214 tokens)

Get one recall by agency and slug

Fetch the full Recall Canary record for a single U.S. federal recall, given the agency and slug returned by search_recalls. Includes the hazard description, the affected product list with lot codes and UPCs, the recommended consumer action, distribution, the agency source link, and the firm slug (`firm.slug`, with `firm.page_url` when the firm has a page) for search_recalls' `firm` filter. Also resolves preliminary agency press releases: an orphan, or a linked one that kept its own URL (its recalls in `linked_recalls`). Read-only.

Input parameters:

- `agency` (string, required): Lowercase agency segment from the record URL. Part of the lookup key, not decoration: a correct slug under the wrong agency is a miss.
- `slug` (string, required): The record slug from its URL, e.g. "acme-foods-peanut-butter". The 26-character ULID id is also accepted and resolves to what its URL shows (for a matched press release, often its recall).

Output parameters:

- `advisory_url` (string|null)
- `agency` (string): Known values: FDA, FDA_IRES, FSIS, CPSC, NHTSA, ADMIN.
- `agency_published_at` (string|null)
- `ai_generated` (object): Provenance: true where the field holds model-written text. Over-attributes on purpose.
- `api_version` (string)
- `canonical` (string): Absolute URL of this representation.
- `category` (string|null): Known values: FOOD, DRUG, BIOLOGIC, DEVICE, COSMETIC, CONSUMER_PRODUCT, VEHICLE, AUTO_EQUIPMENT.
- `company_announced_at` (string|null)
- `company_product_list` (object|null): The company's own list of the affected products, when the agency notice points to it instead of naming them. A product missing from `identification` may still be recalled: check this list.
- `consumer_action` (string|null): The "What to do" text. Null on a withdrawn alert.
- `content_changed_at` (string|null): When the published content last changed.
- `critical_flags` (object|null): NHTSA-only in practice. An absent key means the agency did not state the flag. null for a withdrawn (RETRACTED) record.
- `dates` (object)
- `description` (string|null): Full agency description. FSIS: sanitized HTML; others: plain text. Sanitize or escape before display.
- `display_summary` (string|null)
- `display_summary_short` (string|null)
- `display_title` (string|null)
- `distribution` (object|null)
- `firm` (object)
- `firm_name` (string|null)
- `hazard_tags` (array)
- `html_url` (string): Absolute URL of the human-readable page.
- `id` (string)
- `identification` (object): Page-derived identification: the products and codes the record names. Not a completeness guarantee; `partial` says when the list is incomplete, including when this response cut `products` to 25 (`mcp…
- `late` (object|null): Since api 2.7.0. Null unless the recall is late: it began more than 184 days before listed_at, or it ended on or before the date its listed_at_basis names.
- `license` (object): Attribution and terms (DATA-LICENSE).
- `linked_recalls` (array)
- `listed_at` (string|null): Since api 2.6.0. The date the listing shows and sorts by; equals this record's search_recalls row. A recall's listing date is in dates.listed_at.
- `mcp_truncated` (object): Present only when a long list was cut to 25 for this response.
- `notes` (string): Caveats for this record, including the aggregator-lag and not-a-clearance statement.
- `press_releases` (array)
- `product_count` (integer): The true event scope, which may exceed products.length.
- `products` (array)
- `products_truncated` (boolean): True when `product_count` exceeds the length of `products`
- `published_at` (string|null): Deprecated: the stored pub_date.
- `reason` (string|null): The agency's own stated reason, not model-written.
- `record_type`
- `related` (object)
- `risk` (object|null): The agency rating as the page shows it (for example "High risk" for an FDA Class I recall). Null where the page shows no risk line.
- `severity` (string|null): Known values: CRITICAL, MODERATE, LOW.
- `slug` (string|null)
- `snapshot_at` (string): ISO-8601 UTC response-generation time, second precision. First key on purpose.
- `source_recall_id` (string|null): Agency key; a CPSC one can be stale.
- `source_url` (string|null): The agency's own notice.
- `status` (string|null)
- `story_lead_id` (string|null): Set on a later record of a recall story; the lead it belongs to.
- `story_lead_url` (string|null)
- `timeline` (array): Dated steps of the record, in date order. Each step names who acted on that date. FDA labels: Company began the recall, Announced by the company, Added to FDA's Enforcement Report, Classified by FDA,…
- `title` (string): Agency-published title. Never model-written.
- `units_affected` (number|null)
- `url` (string)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-recallcanary-recall-canary/data-mcp#diagnostics

## Score history

- 2026-11-05: 75
- 2026-11-04: 75
- 2026-11-03: 75
- 2026-11-02: 74
- 2026-11-01: 74
- 2026-10-31: 73
- 2026-10-30: 73
- 2026-10-29: 72
- 2026-10-28: 72
- 2026-10-27: 71

## Common questions

### What is the Recall Canary MCP server?

Recall Canary is an MCP server listed in the public MCP registry as com.recallcanary/recall-canary. U.S. federal product recalls from FDA, FSIS, CPSC, and NHTSA, in one schema. This page covers its hosted endpoint (https://recallcanary.com/data/mcp).

### Is the Recall Canary MCP server safe to use?

Recall Canary scores 75 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Recall Canary MCP server expose?

Recall Canary exposes 2 tools: search_recalls, get_recall. Their descriptions and schemas cost roughly 1,178 tokens of context every time the server is loaded.

### Does the Recall Canary MCP server require authentication?

No. We connected to Recall Canary without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the Recall Canary MCP server still maintained?

Recall Canary is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://recallcanary.com/data/mcp
- Website: https://recallcanary.com/
- Changelog RSS feed: https://verifymcp.io/servers/com-recallcanary-recall-canary/data-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-recallcanary-recall-canary/data-mcp.json
- HTML version of this page: https://verifymcp.io/servers/com-recallcanary-recall-canary/data-mcp