io.github.cyanheads/cpsc-recalls-mcp-server
REMOTE · CPSC-RECALLS.CASEYJHAND.COM · 2 COMPONENTS · SCANNED SEP 20
US consumer product recalls from the CPSC — hazards, remedies, and affected products.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security66
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 3 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC is configured correctly; the domain's records validate against the full chain to the root. View diagnostics → Pass
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability62
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1532 tokens (~510/item across 3 items; 3 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 3 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 4 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the io.github.cyanheads/cpsc-recalls-mcp-server server?
io.github.cyanheads/cpsc-recalls-mcp-server is a hosted endpoint at https://cpsc-recalls.caseyjhand.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · cpsc-recalls.caseyjhand.com
claude mcp add --transport http cyanheads-cpsc-recalls-mcp-server 'https://cpsc-recalls.caseyjhand.com/mcp'
{
"mcpServers": {
"cyanheads-cpsc-recalls-mcp-server": {
"url": "https://cpsc-recalls.caseyjhand.com/mcp"
}
}
} {
"servers": {
"cyanheads-cpsc-recalls-mcp-server": {
"type": "http",
"url": "https://cpsc-recalls.caseyjhand.com/mcp"
}
}
} [mcp_servers.cyanheads-cpsc-recalls-mcp-server] url = "https://cpsc-recalls.caseyjhand.com/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"cyanheads-cpsc-recalls-mcp-server": {
"type": "remote",
"url": "https://cpsc-recalls.caseyjhand.com/mcp",
"enabled": true
}
}
} openclaw mcp add cyanheads-cpsc-recalls-mcp-server --url 'https://cpsc-recalls.caseyjhand.com/mcp' --transport streamable-http
mcp_servers:
cyanheads-cpsc-recalls-mcp-server:
url: "https://cpsc-recalls.caseyjhand.com/mcp" {
"McpServers": {
"cyanheads-cpsc-recalls-mcp-server": {
"Transport": "http",
"Url": "https://cpsc-recalls.caseyjhand.com/mcp"
}
}
} assistant mcp add cyanheads-cpsc-recalls-mcp-server -t streamable-http -u 'https://cpsc-recalls.caseyjhand.com/mcp'
{
"mcpServers": {
"cyanheads-cpsc-recalls-mcp-server": {
"type": "http",
"url": "https://cpsc-recalls.caseyjhand.com/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 0
- Server version: 0.1.7 → 0.1.8 functional
- 9 Sept 26 +1
- Stability: 0.97 → pass security
- 7 Sept 26 −1
- Stability: pass → 0.93 functional
- 26 Aug 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Aug 26 +1
- Stability: 0.97 → pass security
- MCP protocol: Implements a current MCP spec version (2026-07-28). functional
- MCP protocol version: 2025-11-25 → 2026-07-28 functional
- Server version: 0.1.6 → 0.1.7 functional
- 23 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 10 Aug 26 0
- Transport: fail → pass ▲ security
- HSTS header: fail → pass ▲ security
- Authorization: Authorisation not fully verified: no authorisation is required to call this server, and 3 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. security
- Endpoint reachability: not serving MCP → reachable ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Stability: unverified → 0.50 ▲ functional
- MCP protocol: unverified → pass ▲ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Probed https://cpsc-recalls.caseyjhand.com/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=caseyjhand.com | CN=WE1,O=Google Trust Services,C=US | 4 Sept 2026 | 3 Dec 2026 | ECDSA 256 | ECDSA-SHA256 | a6985204ed51ae050e7738aa6be668e9 |
| SANs: caseyjhand.com, *.caseyjhand.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC secure
Validation of cpsc-recalls.caseyjhand.com. — Secure
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| caseyjhand.com. | present | 2371 | 13 | Verified |
| cpsc-recalls.caseyjhand.com. | Verified address RRset verified with the apex keys |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=63072000; includeSubDomains; preload |
| x-content-type-options | nosniff |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://cpsc-recalls.caseyjhand.com/mcp | Verified | 200 | |
| http (plaintext) | http://cpsc-recalls.caseyjhand.com/mcp | HTTPS enforced | 301 | https://cpsc-recalls.caseyjhand.com/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
cpsc_get_recall Get CPSC Recall Detail ~166
Full detail for a single CPSC recall by recall number. Returns the complete record: hazard description, remedy instructions, all product variants, incident/injury reports, images, and the official CPSC recall page URL. Use after cpsc_search_recalls or cpsc_get_recent to get the full picture on a specific recall. CPSC jurisdiction: consumer products only — food, vehicles, drugs, and pesticides are covered by other agencies.
| Name | Type | Req | Description |
|---|---|---|---|
| recall_number | string | yes | CPSC recall number. Modern records (2002–present) are 5-digit numeric, e.g. "25043". Historical records from 1998–2001 may have a letter suffix a–d, e.g. "99003a". Obtain from cpsc_search_recalls res… |
| Name | Type | Req | Description |
|---|---|---|---|
| consumer_contact | string|null | – | Contact information for claiming the remedy. Null when not provided. |
| coordinated_recalls | array | – | URLs of coordinated recalls by other agencies (e.g., Canada Health). |
| cpsc_jurisdiction | string | – | CPSC covers consumer products — toys, electronics, furniture, appliances, tools, clothing. Does NOT cover: food/drugs (FDA), motor vehicles/tires (NHTSA), boats (USCG), pesticides (EPA), firearms (AT… |
| cpsc_url | string | – | Official CPSC recall page — authoritative source for consumers. |
| data_quality_notes | array | – | Gaps this server observed in the upstream CPSC record — absent description, absent hazard text, absent product entries. Derived from which fields CPSC left empty, not from any judgement about the rec… |
| description | string|null | – | Full recall description including product identification details. Model numbers are typically embedded here, not in a structured field. Null when CPSC published the record without a description — rar… |
| distributors | array | – | Distributor company names. |
| error | object | – | Present when the call failed. Absent on success. |
| hazards | array | – | Hazards — read this first. |
| images | array | – | Product and identification images from the recall notice. |
| importers | array | – | Importer company names. |
| injuries | string | – | Injury and incident report narrative, e.g. "None reported" or incident count. |
| last_updated | string | – | Date last published, ISO 8601. |
| manufacturer_countries | array | – | Countries of manufacture. |
| manufacturers | array | – | Manufacturer names (often empty — see importers). |
| products | array | – | Products covered. A recall may include multiple products. Note: model numbers are often in the description text, not a structured field. |
| recall_date | string | – | Date issued, ISO 8601. |
| recall_number | string | – | Recall identifier. |
| remedy_instructions | string | – | Full remedy instructions — exactly what a consumer should do and how to claim. |
| remedy_options | array | – | Remedy types available: Refund, Repair, Replace, New Instructions, Dispose, Label, No Remedy Available, Inspect. Often empty — CPSC classified the remedy on fewer than half its records. Read remedy_i… |
| retailers | array | – | Retailer names with sale date ranges and price. |
| source_note | string | – | Provenance caveat: recall fields are relayed from CPSC unedited and unverified; check cpsc_url before a consumer-facing decision. |
| title | string | – | Official recall title. |
| upcs | array | – | UPC codes for this recall (sparse — ~4% of records have UPCs). UPCs are stored at the recall level in the API, not per-product; when the recall covers multiple products, UPC-to-product attribution is… |
No examples provided.
cpsc_get_recent Get Recent CPSC Recalls ~234
Fetch the most recent CPSC consumer product recalls, ordered newest-first. Use for "what's been recalled lately?" or a product safety feed. Always applies a date window (default: last 30 days) — without a date filter the API returns all 9,800+ records. Page past limit with offset: narrowing days cannot page, because the window is anchored to today and shrinking it drops the oldest records rather than advancing past the newest. CPSC jurisdiction: consumer products only — food, vehicles, drugs, and pesticides are covered by other agencies.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Look back this many days from today. Defaults to 30. Use 7 for a weekly digest, 90 for a quarterly review. |
| limit | integer | – | Maximum number of recalls to return. Defaults to 20. |
| offset | integer | – | Skip this many recalls in the window before returning results. Combine with limit to page through total_found — e.g. limit 20 with offset 0, 20, 40. An offset at or past total_found returns an empty… |
| Name | Type | Req | Description |
|---|---|---|---|
| cpsc_jurisdiction | string | – | CPSC covers consumer products — toys, electronics, furniture, appliances, tools, clothing. Does NOT cover: food/drugs (FDA), motor vehicles/tires (NHTSA), boats (USCG), pesticides (EPA), firearms (AT… |
| error | object | – | Present when the call failed. Absent on success. |
| has_more | boolean | – | True when recalls remain past this window — call again with offset raised by the number of recalls returned. |
| offset | number | – | Number of recalls skipped before this window. |
| period | object | – | Date range queried. |
| recalls | array | – | Recent recalls, newest-first. |
| source_note | string | – | Provenance caveat: recall fields are relayed from CPSC unedited and unverified; check cpsc_url before a consumer-facing decision. |
| total_found | number | – | Total recalls in this period, counted before offset and limit narrow the window. |
| truncated | boolean | – | True when total_found exceeds the limit. Independent of offset. |
No examples provided.
cpsc_search_recalls Search CPSC Recalls ~1,034
Search consumer product recalls from the CPSC (Consumer Product Safety Commission) database. Covers toys, electronics, furniture, appliances, children's products, tools, and clothing — everything under CPSC jurisdiction. Does NOT cover food/drugs (FDA), motor vehicles/tires (NHTSA), boats (USCG), or pesticides (EPA). All filter fields are optional substring matches that combine with AND. Start with title_search when you have a product in hand — CPSC titles carry the brand, product, and hazard phrasing. For hazard-type filtering ("fire", "choking", "burn"), use hazard_search, which matches hazard text, product names, and remedy instructions in one pass. When manufacturer returns no results, try importer, retailer, or distributor: many recalls list one of those as the primary responsible org. Page past limit with offset — total_found and has_more say where the window sits in the full result set. Use cpsc_get_recall with a recall_number from results to retrieve the full record including complete description, all images, and incident reports.
| Name | Type | Req | Description |
|---|---|---|---|
| date_end | – | – | Include only recalls on or before this date. ISO 8601 format: "YYYY-MM-DD". Must be a real calendar date, and on or after date_start. |
| date_start | – | – | Include only recalls on or after this date. ISO 8601 format: "YYYY-MM-DD". Must be a real calendar date — "2026-02-31" and "2026-99-99" are rejected. |
| description_search | string | – | Keyword search within the recall Description field only (does not search Title, Hazards, or remedy text). Use for product details not captured in product_name — model numbers, colors, sale channels.… |
| distributor | string | – | Distributor company name, e.g. "Walmart", "Costco". Substring match against the Distributors array — a role distinct from retailer and importer, and populated on far fewer records. |
| hazard_search | string | – | Hazard or safety-concept keyword, e.g. "fire", "choking", "burn", "laceration". Applied client-side after the upstream fetch. Matches when the term appears in any of: hazard descriptions, product nam… |
| importer | string | – | Importer company name. Use when searching for recalls by the company that brought the product into the US. |
| limit | integer | – | Maximum number of results to return (applied client-side — the API returns all matches). Defaults to 20. |
| manufacturer | string | – | Manufacturer name, e.g. "Samsung", "LEGO". Substring match against the Manufacturers array. Note: many recalls list the importer or retailer as the primary org rather than the manufacturer — try impo… |
| offset | integer | – | Skip this many matching records before returning results. Combine with limit to page through total_found — e.g. limit 20 with offset 0, 20, 40. An offset at or past total_found returns an empty resul… |
| product_name | string | – | Product name to search for, e.g. "crib", "space heater", "bicycle". Substring match — partial names work. |
| remedy | string | – | Keyword search within the free-text remedy instructions, e.g. "repair", "refund", "firmware update". Substring match, applied upstream. This searches the remedy narrative, not the structured remedy_o… |
| retailer | string | – | Retailer name, e.g. "Walmart", "Target", "Amazon". Substring match against the retailer narrative (which includes store name, dates sold, and price). |
| title_search | string | – | Keyword search within the recall Title, e.g. "chandelier", "space heater", "inclined sleeper". Substring match. CPSC titles name the brand, the product, and the hazard, which makes this the highest-s… |
| updated_end | – | – | Include only recalls last published by CPSC on or before this date. ISO 8601 format: "YYYY-MM-DD". Must be a real calendar date, and on or after updated_start. |
| updated_start | – | – | Include only recalls last published by CPSC on or after this date. ISO 8601 format: "YYYY-MM-DD". A separate axis from date_start: a 2003 recall re-published in 2025 matches updated_start "2025-01-01… |
| Name | Type | Req | Description |
|---|---|---|---|
| cpsc_jurisdiction | string | – | CPSC covers consumer products — toys, electronics, furniture, appliances, tools, clothing. Does NOT cover: food/drugs (FDA), motor vehicles/tires (NHTSA), boats (USCG), pesticides (EPA), firearms (AT… |
| error | object | – | Present when the call failed. Absent on success. |
| has_more | boolean | – | True when records remain past this window — call again with offset raised by the number of recalls returned. |
| offset | number | – | Number of matching records skipped before this window. |
| recalls | array | – | Matching recalls, ordered newest-first. |
| source_note | string | – | Provenance caveat: recall fields are relayed from CPSC unedited and unverified; check cpsc_url before a consumer-facing decision. |
| total_found | number | – | Total matching records, counted after hazard_search is applied and before offset and limit narrow the window. |
| truncated | boolean | – | True when total_found exceeds the limit. Independent of offset. |
No examples provided.
What is the io.github.cyanheads/cpsc-recalls-mcp-server server?
io.github.cyanheads/cpsc-recalls-mcp-server is listed in the public MCP registry as io.github.cyanheads/cpsc-recalls-mcp-server. US consumer product recalls from the CPSC, hazards, remedies, and affected products. This page covers its hosted endpoint (https://cpsc-recalls.caseyjhand.com/mcp).
Is the io.github.cyanheads/cpsc-recalls-mcp-server server safe to use?
io.github.cyanheads/cpsc-recalls-mcp-server scores 80 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.cyanheads/cpsc-recalls-mcp-server server expose?
io.github.cyanheads/cpsc-recalls-mcp-server exposes 3 tools: cpsc_search_recalls, cpsc_get_recall, cpsc_get_recent. Their descriptions and schemas cost roughly 1,434 tokens of context every time the server is loaded.
Does the io.github.cyanheads/cpsc-recalls-mcp-server server require authentication?
No. We connected to io.github.cyanheads/cpsc-recalls-mcp-server without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the io.github.cyanheads/cpsc-recalls-mcp-server server still maintained?
io.github.cyanheads/cpsc-recalls-mcp-server is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.