US Flood Zone & Property Risk (FEMA, NOAA, USGS, Census)
REMOTE · MCP.THESTACKUNDERFLOW.COM
FEMA flood zone, hazard history and demographics for any US address, with sources on every answer.
Available components
Last scanned (11 hours ago)
Scores higher than 63% of remote servers
Reachable. Last reached 18 Oct 2026.
Category Maps and Location
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security77
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC is configured correctly; the domain's records validate against the full chain to the root. View diagnostics → Pass
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability73
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 2269 tokens (~252/item across 9 items; 6 tools + 3 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management17
- Stability observed for 5 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage87
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 53% of tool parameters carry a description.Partial
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 6 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 8 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 18 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Oct 26 0
- Server version: 0.1.0 → 0.2.0 functional
- 14 Oct 26 +1
- Stability: unverified → 0.03 ▲ functional
- 13 Oct 26 +63
- HSTS header: unverified → fail ▼ security
- Authorization: unverified → partial ▲ security
- Injection markers: unverified → pass ▲ security
- TLS certificate: unverified → pass ▲ security
- Transport: fail → pass ▲ security
- First check of Judged manipulation: pass security
- MCP protocol: unverified → fail ▼ functional
- Tool coverage: unverified → 100 ▲ functional
- Schema quality: unverified → 100 ▲ functional
- First check of Schema quality: fail functional
- First check of Tool coverage: 53 functional
- First check of Destructive annotations: pass functional
- First check of Schema quality: fail functional
- First check of Schema quality: good functional
- First check of Tool coverage: 100 functional
- 12 Oct 26 6
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 18 Oct 2026 · Probed https://mcp.thestackunderflow.com/mcp/property
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=mcp.thestackunderflow.com | CN=YE1,O=Let's Encrypt,C=US | 11 Oct 2026 | 9 Jan 2027 | ECDSA 256 | ECDSA-SHA384 | 610a36eecc75ea18ef38580dceaa9cae4b7 |
| SANs: mcp.thestackunderflow.com | ||||||
| CN=YE1,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 5ddd70dd31f801c85c186a7a04b80afe |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC secure
Validation of mcp.thestackunderflow.com. — Secure
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| thestackunderflow.com. | present | 2371 | 13 | Verified |
| mcp.thestackunderflow.com. | Verified address RRset verified with the apex keys |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.thestackunderflow.com/mcp/property | Verified | 200 | |
| http (plaintext) | http://mcp.thestackunderflow.com/mcp/property | HTTPS enforced | 301 | https://mcp.thestackunderflow.com/mcp/property |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
address_profile Address Profile ~365
One-call US property report for an address or coordinate: FEMA flood zone (SFHA, base flood elevation, FIRM panel), county demographics, and 10-year hazard history (FEMA disaster declarations, NOAA storm events, USGS earthquakes), with a plain-English summary and a source for every part. Everything the property pack knows about one US address, in one call: - **location**: the point used, and the state, county and census tract. - **flood**: the FEMA flood zone at the point, exactly as `flood_zone` returns it. - **demographics**: county population and median household income (ACS 5-year estimates). - **hazards**: counts of FEMA declarations (and major disasters) and their types, NOAA storm events, deaths and reported damage, and USGS earthquakes within 100 km (since 1950), over the last ten years. Every section has a `status`. The flood zone is required: if FEMA's map cannot be read, no report is produced and the call is not charged. Any other section that fails is marked unavailable and the report still returns. Informational screening only; see the disclaimer in the answer. When to use: Use when the user wants an overview of a US property or address (flood risk, neighbourhood, disaster history) rather than one specific fact. One call replaces flood_zone, hazard_history and area_demographics; quote the `summary` and keep the `disclaimer`. Billed as property.address_profile at 8c. Every response includes a sources[] array naming the data origin and licence.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | – | A US street address. |
| lat | number | – | – |
| lon | number | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| demographics | object | yes | – |
| disclaimer | string | yes | – |
| flood | object | yes | – |
| hazards | object | yes | – |
| location | object | yes | – |
| summary | string | yes | – |
No examples provided.
admin_areas Admin Areas ~209
State and county for a coordinate, with Census GEOIDs. Free - answered from boundaries the platform ingests and holds, with no provider call. Point-in-polygon against Census TIGER/Line boundaries (§22.2). Returns the administrative areas containing the point, most specific first, each with the GEOID that every other census dataset is keyed by. Tract, ZCTA and place follow when those layers are ingested. A coordinate exactly on a county line is genuinely in both counties and both are returned - the alternative is an address falling into a gap. Take the first if you need one answer. When to use: Use to turn a coordinate into a county or state GEOID before asking for any census-keyed data. Free, so there is no reason to guess a FIPS code. This tool is free and does not consume plan credits. Every response includes a sources[] array naming the data origin and licence.
| Name | Type | Req | Description |
|---|---|---|---|
| lat | number | yes | – |
| lon | number | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| areas | array | yes | – |
No examples provided.
area_demographics Area Demographics ~219
Population and median household income for the county containing a point, from American Community Survey 5-year estimates. Composes two ingested datasets (§22.2): TIGER/Line resolves the coordinate to a county GEOID, then the ACS layer is read by that key. Pass `geoid` directly to skip the boundary lookup. Values are survey ESTIMATES with margins of error, not counts, and a suppressed estimate is returned as null rather than filled in. The release that produced them is in `dataset_version` and in each metric's `period`. When to use: Use for "how many people live in this area" or "what is the median income there". Give a coordinate, or a county GEOID from admin_areas. Billed as property.area_demographics at 1c. Every response includes a sources[] array naming the data origin and licence.
| Name | Type | Req | Description |
|---|---|---|---|
| geoid | string | – | Five-digit county GEOID, if you already have one. |
| lat | number | – | – |
| lon | number | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| area | object | – | – |
| metrics | array | yes | – |
No examples provided.
census_geocode Census Geocode ~224
Free. Turns a US street address into a latitude/longitude plus the state, county and census tract it is in (with GEOIDs), using the U.S. Census Bureau geocoder. Use it first, then pass the point to the paid property tools. One-line address to point, with the Census Bureau's own match: the matched address, ZIP code, coordinates and the state, county and tract containing them. An address the geocoder cannot place is reported as not found, never guessed. US addresses only; PO boxes and rural routes often do not match. When to use: Use when you have a US street address and need its coordinates, county or census tract. Free. flood_zone, hazard_history and address_profile also accept the address directly, so call this only when the user wants the location itself. This tool is free and does not consume plan credits. Every response includes a sources[] array naming the data origin and licence.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | A US street address, e.g. "411 Legislative Ave, Dover, DE 19901". |
| Name | Type | Req | Description |
|---|---|---|---|
| address | object | yes | – |
| areas | array | yes | – |
No examples provided.
flood_zone Flood Zone ~504
FEMA flood zone for a US address or coordinate: zone (A, AE, VE, X ...), whether it is in the Special Flood Hazard Area (where lenders generally require flood insurance), base flood elevation with its datum, FIRM panel and effective date, NFIP community, and any Letter of Map Revision. Live from FEMA's National Flood Hazard Layer, with a plain-English summary. Reads FEMA's National Flood Hazard Layer at one point, live, so the answer is FEMA's current effective map: the flood zone and subtype, a risk level (high, coastal high, moderate, minimal, undetermined, unmapped), whether the point is in the Special Flood Hazard Area or a floodway, the base flood elevation in its unit and vertical datum (null, never 0, where no single elevation is published: it then varies along the flooding source and is read from the FIRM profile), the FIRM panel and its effective date, the NFIP community, any Letter of Map Revision in effect, and notes where FEMA's own flags disagree with the zone. Answers are cached for up to 30 days. An address is geocoded with the Census Bureau geocoder first, and the point used is returned; an ambiguous address is refused with its candidates. A point FEMA has not mapped digitally is reported as unmapped, not as low risk, and a point with no FEMA data at all (outside the US) is not found and not charged. On a zone boundary the higher-risk zone is reported and the others listed. Informational screening only: not an official flood zone determination (Standard Flood Hazard Determination Form), not an elevation certificate, and not insurance or lending advice. Every answer carries that disclaimer. When to use: Use when asked whether a US property is in a flood zone, needs flood insurance, is in the SFHA or a floodway, or for its FEMA zone, base flood elevation or FIRM panel. Quote the `summary` and keep the `disclaimer` with it. For flood plus everything else about an address in one call, use address_profile. Billed as property.flood_zone at 2c. Every r…
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | – | A US street address. Geocoded with the Census Bureau geocoder. |
| lat | number | – | Latitude, with lon, instead of an address. |
| lon | number | – | Longitude, with lat. |
| Name | Type | Req | Description |
|---|---|---|---|
| disclaimer | string | yes | – |
| flood | object | yes | – |
| point | object | yes | – |
| summary | string | yes | – |
No examples provided.
hazard_history Hazard History ~582
Natural-hazard history for a US county or address: FEMA declarations (major disasters, emergencies and fire management, by type, with links), NOAA storm events with deaths and reported property damage by type and year, and USGS earthquakes within 100 km since 1950. One call, each source reported apart. Three federal sources, fetched together: - **FEMA declarations** for the county since 1 January of the first year: the total (major disasters, emergencies and fire management), major disasters alone, count by incident type, and the declarations themselves with FEMA ids and links. Statewide declarations are included. - **NOAA Storm Events** for the county: events, deaths, injuries and reported property and crop damage (nominal dollars; unreported damage counts as 0, so it is a floor), by type and by year, plus the worst events. Events NOAA records for a forecast zone covering only this county (most heat and winter-storm deaths) count as the county's own; a zone covering several counties is counted, but its casualties and damage are reported apart in `zone_based`, because they are shared. The current year is incomplete; NOAA can trail by months. - **USGS earthquakes** of magnitude 2.5 or more within 100 km of the point since 1950: the count and the five largest. This needs a point, so it is skipped when only a county GEOID is given. Each section has its own `status`; if one source is down the others still answer. If neither FEMA nor NOAA can answer, the call fails and is not charged. Connecticut's planning regions (since 2022) are not yet matched to the old counties FEMA and NOAA still use, so they are not answered; the old county GEOIDs (09001-09015) work. A GEOID that is not a county is not found. A `geoid` is used only when no address or coordinate is given. When to use: Use for "has this area had floods, hurricanes or earthquakes", disaster declarations, storm damage history, or natural-hazard due diligence for a US property or county. Fo…
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | – | A US street address. |
| geoid | string | – | Five-digit county GEOID, instead of a place (no earthquake section then). |
| lat | number | – | – |
| lon | number | – | – |
| years | integer | – | Full years back from 1 January, plus the current year so far. |
| Name | Type | Req | Description |
|---|---|---|---|
| county | object | yes | – |
| disasters | object | yes | – |
| earthquakes | object | yes | – |
| point | object | – | – |
| storms | object | yes | – |
| summary | string | yes | – |
| years | object | yes | – |
No examples provided.
How do I install the US Flood Zone & Property Risk (FEMA, NOAA, USGS, Census) MCP server?
US Flood Zone & Property Risk (FEMA, NOAA, USGS, Census) is a hosted endpoint at https://mcp.thestackunderflow.com/mcp/property, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · mcp.thestackunderflow.com
claude mcp add --transport http com-thestackunderflow-datum-property 'https://mcp.thestackunderflow.com/mcp/property'
What is the US Flood Zone & Property Risk (FEMA, NOAA, USGS, Census) MCP server?
US Flood Zone & Property Risk (FEMA, NOAA, USGS, Census) is an MCP server listed in the public MCP registry as com.thestackunderflow/datum-property. FEMA flood zone, hazard history and demographics for any US address, with sources on every answer. This page covers its hosted endpoint (https://mcp.thestackunderflow.com/mcp/property).
Is the US Flood Zone & Property Risk (FEMA, NOAA, USGS, Census) MCP server safe to use?
US Flood Zone & Property Risk (FEMA, NOAA, USGS, Census) scores 72 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the US Flood Zone & Property Risk (FEMA, NOAA, USGS, Census) MCP server expose?
US Flood Zone & Property Risk (FEMA, NOAA, USGS, Census) exposes 6 tools: address_profile, admin_areas, area_demographics, census_geocode, flood_zone, hazard_history. Their descriptions and schemas cost roughly 2,103 tokens of context every time the server is loaded.
Does the US Flood Zone & Property Risk (FEMA, NOAA, USGS, Census) MCP server require authentication?
No. We connected to US Flood Zone & Property Risk (FEMA, NOAA, USGS, Census) without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the US Flood Zone & Property Risk (FEMA, NOAA, USGS, Census) MCP server still maintained?
US Flood Zone & Property Risk (FEMA, NOAA, USGS, Census) is still listed as active in the MCP registry. We last reached this channel on 18 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.