Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.cyanheads/faostat-mcp-server

REMOTE · FAOSTAT.CASEYJHAND.COM · 2 COMPONENTS

UN FAOSTAT global food & agriculture statistics over a local SQLite mirror, via MCP.

−1 this week 88 Trust /100

Last scanned (2 hours ago)

Scores higher than 96% of remote servers

Reachable. Last reached 5 Nov 2026.

Category Data and Analytics

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security83
Transport & Reachability100
Schema Quality & AI Usability73
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2979 tokens (~425/item across 7 items; 6 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 6 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 8 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Nov 26 −1
    • The server rewrote its instructions, which are the text every model session reads security
    • Tool “faostat_dataframe_query” rewrote its description, which is the text the model reads security
    • Tool “faostat_query_observations” rewrote its description, which is the text the model reads security
    • Tool “faostat_resolve_codes” rewrote its description, which is the text the model reads security
    • Server version: 0.5.0 → 0.6.0 functional
    • “faostat_resolve_codes” added an optional parameter “item_codes_text” cosmetic
    • “faostat_resolve_codes” added an optional parameter “item_codes” cosmetic
    • “faostat_query_observations” added an optional parameter “item_codes_text” cosmetic
    • “faostat_query_observations” added an optional parameter “source_codes” cosmetic
    • “faostat_resolve_codes” added an optional parameter “code_text” cosmetic
  • 28 Oct 26 +3
    • Schema quality: 472 → 412 ▲ functional
    • Schema quality: unverified → 100 ▲ functional
    • New resource “faostat-guide” functional
    • Server version: 0.4.1 → 0.5.0 functional
  • 25 Oct 26 0
    • Server version: 0.4.0 → 0.4.1 functional
  • 18 Oct 26 0
    • Tool “faostat_commodity_profile” rewrote its description, which is the text the model reads security
    • Server version: 0.3.0 → 0.4.0 functional
    • “faostat_commodity_profile” added an optional parameter “item_code” cosmetic
    • “faostat_commodity_profile” reworded the description of “item_query” cosmetic
    • “faostat_commodity_profile” made “item_query” optional cosmetic
  • 4 Oct 26 0
    • Server version: 0.2.5 → 0.3.0 functional
  • 30 Sept 26 0
    • Tool “faostat_query_observations” rewrote its description, which is the text the model reads security
    • Tool “faostat_commodity_profile” rewrote its description, which is the text the model reads security
    • Server version: 0.2.4 → 0.2.5 functional
    • “faostat_dataframe_query” reworded the description of “sql” cosmetic
  • 28 Sept 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 25 Sept 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Probed https://faostat.caseyjhand.com/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=caseyjhand.com CN=WE1,O=Google Trust Services,C=US 2 Nov 2026 31 Jan 2027 ECDSA 256 ECDSA-SHA256 995a30681ab772540e934241ca1d576c
SANs: caseyjhand.com, *.caseyjhand.com
CN=WE1,O=Google Trust Services,C=US (CA) CN=GTS Root R4,O=Google Trust Services LLC,C=US 13 Dec 2023 20 Feb 2029 ECDSA 256 ECDSA-SHA384 7ff31977972c224a76155d13b6d685e3
CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE 15 Nov 2023 28 Jan 2028 ECDSA 384 SHA256-RSA 7fe530bf331343bedd821610493d8a1b

Background: What to check on a remote MCP endpoint →

DNSSEC secure

Validation of faostat.caseyjhand.com. — Secure

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
com. present 19718 13 Verified
caseyjhand.com. present 2371 13 Verified
faostat.caseyjhand.com. Verified address RRset verified with the apex keys
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200
Header Value
strict-transport-security max-age=63072000; includeSubDomains; preload
x-content-type-options nosniff

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://faostat.caseyjhand.com/mcp Verified 200
http (plaintext) http://faostat.caseyjhand.com/mcp HTTPS enforced 301 https://faostat.caseyjhand.com/mcp
MCP tools · 6 exposed · ~2,668 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
faostat_commodity_profile ~423

Assemble a global profile for one QCL item in a single call: top-producing countries, the annual production trend, and trade flows (top exporters and importers). Supply item_code or item_query; code wins when both are supplied. A query selects a unique normalized exact label, otherwise a unique relevance match; ambiguous queries require an explicit code. Each ranking uses the selected item at each country's own latest year with data, grouped by unit. The trend is returned inline as year/value points. Country-level only (aggregates excluded). QCL is required; unavailable TCL yields a production-only profile with a notice. When the merged observation set is too large to inline, it spills to a DataCanvas table (canvas_id + table_name) — call faostat_dataframe_describe for its columns, then faostat_dataframe_query for deeper SQL.

NameTypeReqDescription
canvas_idstring–Canvas ID to stage onto, as returned by a prior faostat_query_observations / faostat_commodity_profile call — exactly 10 characters of letters, digits, hyphens, and underscores. Omit to stage onto th…
item_codeinteger–Exact item code present in QCL; takes precedence over item_query. Obtain it from faostat_resolve_codes with domain QCL and dimension item.
item_querystring–Commodity label or search term (e.g. "Wheat"). A unique normalized exact QCL label wins, otherwise the relevance search must match exactly one item. Broad queries such as "maize" or "milk" require it…
top_ninteger–Number of top producers / exporters / importers to return. Max 50.
year_endinteger–Inclusive end year for the trend (e.g. 2022).
year_startinteger–Inclusive start year for the trend (e.g. 1990).
NameTypeReqDescription
canvas_idstring–Canvas ID this call staged onto. When spilled it holds table_name — pass both to faostat_dataframe_describe (table_name as name) for the columns and types, then canvas_id to faostat_dataframe_query f…
errorobject–Present when the call failed. Absent on success.
item_querystring–Supplied query echoed back, or the canonical selected label for code-only calls.
itemsTruncatedboolean–Always false: successful profiles select one item without truncating selection.
noticestring–States where the observation set went — the canvas table, inline result, staging failure, or disabled canvas — plus unavailable trade data, mixed units, or other partial-result context.
production_trendarray–The annual production series for the selected item, summed over countries per year and ordered oldest-first. Aggregated in SQL over the complete filtered match, so it is not affected by the canvas st…
resolvedItemCodesarray–Item codes the commodity query resolved to.
resolvedItemMatchesnumber–Number of selected QCL items; always one for a successful profile.
resolved_itemsarray–The single selected QCL item and its canonical label.
spilledboolean–True when the merged observation set was staged on a canvas table.
staged_row_countnumber–Rows actually staged on the merged canvas table (present when spilled). Equals the 50,000-row cap when truncated.
table_namestring–Canvas table holding the staged observations — production plus trade when the trade domain (TCL) is indexed, production only when it is not (present when spilled). The notice names which of the two t…
top_exportersarray–Top exporters by summed export quantity (empty when trade is not indexed).
top_importersarray–Top importers by summed import quantity (empty when trade is not indexed).
top_producersarray–Top producers by summed production (countries only).
trend_pointsnumber–Total production observations aggregated into production_trend. Exact — the aggregation runs over the complete filtered match, not a capped page.
truncatedboolean–True when the STAGED CANVAS TABLE hit the 50,000-row staging cap and is therefore a PREFIX of the merged observation set — re-query faostat_query_observations partitioned by year to stage the rest. T…

No examples provided.

faostat_dataframe_describe ~319

List the canvas tables (faostat_xxxxxxxx) staged by faostat_query_observations and faostat_commodity_profile, each with its source tool, the query parameters that produced it, creation/expiry timestamps, row count, and column schema. Call this before faostat_dataframe_query to discover the exact table and column names to reference in SQL. Tables are listed newest-first and paged: pass `name` to describe one table outright, or page with `offset` + `limit` — when the response reports `truncated`, pass the returned `nextOffset` to fetch the rest.

NameTypeReqDescription
canvas_idstring–Optional canvas ID as returned by a prior faostat_query_observations / faostat_commodity_profile call — exactly 10 characters of letters, digits, hyphens, and underscores. Omit to list the tables sta…
limitinteger–Maximum staged tables to return on this page (max 100). Each entry carries a full column schema, so the default keeps a discovery call small.
namestring–Optional table name (faostat_xxxxxxxx) to describe a single staged table. Takes precedence over `offset` / `limit`, which are ignored for a name lookup (always single-page).
offsetinteger–Zero-based pagination offset into the staged tables (newest first). When the response reports truncated, pass the returned nextOffset here to fetch the next page. Ignored for `name` lookups.
NameTypeReqDescription
errorobject–Present when the call failed. Absent on success.
nextOffsetinteger–Offset to pass on the next call to fetch the following page. Present only when truncated is true; absent on the last page and for `name` lookups.
noticestring–Guidance when nothing is staged yet or more pages remain.
tablesarray–Active staged tables for this session, newest first — one page of them. Empty when none are staged.
totalMatchesnumber–Staged tables on the resolved canvas, before the page limit is applied.
truncatedboolean–True when more staged tables remain beyond the returned page — fetch them with nextOffset. Always false for a single-table `name` lookup, which is never paged.

No examples provided.

faostat_dataframe_query ~341

Run a single-statement SELECT against canvas tables staged by faostat_query_observations and faostat_commodity_profile (faostat_xxxxxxxx). Use DuckDB joins, aggregates, window functions, and CTEs for rankings and time-series analysis. Item groups can overlap their members even with matching units; do not sum them together, and resolver kind=null does not establish safe-to-sum. Separate source methodologies and respect bounded values and multi-year periods. Read-only: writes, DDL, DROP, COPY, PRAGMA, ATTACH, and external-file functions are rejected; system catalogs are denied. List tables and columns with faostat_dataframe_describe. Preserve data-quality flags in projections: commonly A=Official, B=time-series break, E=Estimated, I=Imputed, M=Missing, T=Unofficial, X=international organization; unrecognized flags never establish official status.

NameTypeReqDescription
canvas_idstring–Optional canvas ID as returned by a prior faostat_query_observations / faostat_commodity_profile call — exactly 10 characters of letters, digits, hyphens, and underscores. Omit to query the tables st…
row_limitinteger–Hard cap on rows in the response. Default 1000, max 10000.
sqlstringyesSingle-statement read-only SELECT against staged faostat_<id> tables. Columns: area_code, area, item_code, item, element_code, element, year, unit, value, flag — plus domain (QCL or TCL) on tables st…
NameTypeReqDescription
columnsarray–Column names in projection order.
errorobject–Present when the call failed. Absent on success.
noticestring–Guidance when the query returned no rows or when results were capped.
row_countnumber–Rows returned in this response — the materialized count, equal to rows.length. When truncated is true this is NOT the full result total (this path computes no exact total); page or aggregate to reach…
rowsarray–Materialized result rows, bounded by row_limit.
truncatedboolean–True when row_limit capped the result and more rows exist than were returned. To reach them: page with ORDER BY + SQL LIMIT/OFFSET, raise row_limit (max 10000), or aggregate with GROUP BY.

No examples provided.

faostat_list_domains ~392

Discover FAOSTAT statistical domains (production, trade, food balances, food security, land use, agri-emissions, prices, value) with their codes, descriptions, last-update date, upstream row count, and local index status. Every query keys on a domain code from here. The `indexed` flag tells you which domains are queryable right now; un-indexed domains exist in the catalog but must be added to FAOSTAT_DOMAINS and re-synced before faostat_query_observations can read them. The catalog runs to ~69 domains with long descriptions, so responses are paged: narrow with `topic` / `indexed_only`, pass `code` to fetch one domain outright, or page with `offset` + `limit` — when the response reports `truncated`, pass the returned `nextOffset` to fetch the rest.

NameTypeReqDescription
codestring–Exact domain code lookup (e.g. "RL"), case-insensitive. Returns that one domain's full record on a single page. Takes precedence over `topic` / `indexed_only` when provided.
indexed_onlyboolean–When true, return only domains indexed in the local mirror (queryable now).
limitinteger–Maximum domains to return on this page (max 200 — above the catalog size, so raise it to fetch everything at once). Domain descriptions are long; the default keeps a browse call small.
offsetinteger–Zero-based pagination offset into the matching domains (code-sorted). When the response reports truncated, pass the returned nextOffset here to fetch the next page. Ignored for exact-code lookups (al…
topicstring–Case-insensitive substring filter over domain code, name, and topic (e.g. "trade", "emissions", "QCL"). Omit to list the full catalog.
NameTypeReqDescription
domainsarray–Matching domains, sorted by code.
errorobject–Present when the call failed. Absent on success.
indexedCountnumber–Domains currently indexed in the local mirror.
nextOffsetinteger–Offset to pass on the next call to fetch the following page. Present only when truncated is true; absent on the last page and for exact-code lookups.
noticestring–Guidance when a filter matched nothing, more pages remain, or no domains are indexed yet.
totalCountnumber–Total domains in the FAOSTAT catalog, independent of any filter.
totalMatchesnumber–Domains matching the current filters, before the page limit is applied.
truncatedboolean–True when more matches remain beyond the returned page — fetch them with nextOffset.

No examples provided.

faostat_query_observations ~666

Query a FAOSTAT domain's data cube by area(s), item(s), element(s), sources, and year range, returning values with units and data-quality flags. Resolve numeric codes or exact alphanumeric item identities with faostat_resolve_codes; element resolution accepts item selectors and returns units. Empty queries with explicit items and elements list available elements for those items across the domain, without establishing area/year/source coverage. Aggregate regions are excluded by default; include_aggregates=true returns roll-ups, and explicit area_codes are honored verbatim. Item groups can overlap their members even with matching units; they remain included, and kind=null does not establish safe-to-sum. Keep source methodologies separate. Small results return inline; large ones spill to a DataCanvas table (canvas_id + table_name); call faostat_dataframe_describe for columns, then faostat_dataframe_query for analysis. Honor every row's flag: commonly A=Official, B=time-series break, E=Estimated, I=Imputed, M=Missing, T=Unofficial, X=international organization; unrecognized flags never establish official status.

NameTypeReqDescription
area_codesarray–Area codes from faostat_resolve_codes. When set, aggregates are NOT auto-excluded — the codes are honored verbatim.
canvas_idstring–Canvas ID to stage onto, as returned by a prior faostat_query_observations / faostat_commodity_profile call — exactly 10 characters of letters, digits, hyphens, and underscores. Omit to stage onto th…
domainstringyesFAOSTAT domain code (e.g. "QCL"). Must be indexed locally.
element_codesarray–Element codes from faostat_resolve_codes (e.g. 5510 Production).
include_aggregatesboolean–When false (default), exclude aggregate-region rows (codes ≥ 5000 plus a few curated sub-threshold roll-ups such as China=351) so sums are not double-counted. Set true for World/continent/grouping ro…
item_codesarray–Item codes from faostat_resolve_codes.
item_codes_textarray–Exact alphanumeric item identities from resolver code_text; mutually exclusive with item_codes. Numeric codes use item_codes.
limitinteger–Max observations returned inline — also the preview size when the result stages to a canvas table. Rows past it are never dropped silently: a match larger than limit stages in full to a DataCanvas ta…
source_codesarray–Exact source codes, such as 3050 or 3051 in GLE. Omit to return every methodology; choose or group sources before summing.
year_endinteger–Inclusive end year (e.g. 2022).
year_startinteger–Inclusive start year (e.g. 2000).
NameTypeReqDescription
available_elementsarray–On an empty query with explicit items and elements: all elements available for those items across the domain. Does not establish coverage for requested area/year/source filters.
canvas_idstring–Canvas ID holding the staged table (present when spilled) — pass it with table_name to faostat_dataframe_describe for the columns and types, then to faostat_dataframe_query for SQL.
domainstring–The domain code echoed back.
errorobject–Present when the call failed. Absent on success.
noticestring–Guidance on empty results, aggregate exclusion, or how to reach the spilled set.
observationsarray–Inline observations (preview when the full set spilled to a canvas table).
spilledboolean–True when the full result was staged on a DataCanvas table.
staged_row_countnumber–Rows actually staged on the canvas table (present when spilled). Equals the full match count unless truncated, in which case it is the 50,000-row cap.
table_namestring–Canvas table holding the staged result set (present when spilled; a PREFIX of the match when truncated) — pass it as name to faostat_dataframe_describe, then reference it in faostat_dataframe_query S…
totalCountnumber–Observations matched. Exact when the result was returned inline or fully staged. A floor — more matched — in two cases, both named by the notice: the match exceeded the 50,000-row staging cap (trunca…
truncatedboolean–True when the staged table hit the 50,000-row staging cap — the staged set is a PREFIX of the match, not the complete result. Partition the query by year or code ranges to capture the rest.

No examples provided.

faostat_resolve_codes ~527

Resolve labels to the numeric codes or exact alphanumeric item identities faostat_query_observations needs: areas (countries/regions), items (commodities), and elements (metrics). Use query for full-text matching, name_contains for substring matching, code or code_text for exact identity, or omit them to list. Item and element matches occur in the selected domain; areas use shared vocabulary. For elements, optionally pass item_codes or item_codes_text to discover metrics and distinct units observed for those items; this does not establish area/year/source coverage. Empty item selectors match nothing. Page with offset and limit using nextOffset when truncated. Areas carry country/aggregate classification. Verified domain-specific item groups carry aggregate; null means unclassified, not safe-to-sum. Item groups can overlap their members even with matching units. Area aggregates include codes ≥ 5000 and curated roll-ups such as China=351; exclude overlapping regional and country rows when summing.

NameTypeReqDescription
codeinteger–Exact code lookup. Takes precedence over `query`/`name_contains` when provided.
code_textstring–Exact alphanumeric item code. Only for dimension item; mutually exclusive with code. Numeric identities use code.
dimensionstringyesWhich dimension to resolve: "area" (countries/regions), "item" (commodities), or "element" (metrics).
domainstringyesFAOSTAT domain code (e.g. "QCL"). Item and element resolution is scoped to the codes present in this domain's data; area code lists are shared across all indexed domains.
item_codesarray–For element resolution only: restrict elements and units to these items. Empty matches nothing; omit for domain-wide elements. Mutually exclusive with item_codes_text.
item_codes_textarray–For element resolution only: restrict elements and units to these exact text items. Empty matches nothing; mutually exclusive with item_codes.
limitinteger–Maximum matches to return (max 200).
name_containsstring–Case-insensitive substring filter over the label. Used only when `query` is omitted.
offsetinteger–Zero-based pagination offset into the match set. When the response reports truncated, pass the returned nextOffset here to fetch the next page. Ignored for exact-code lookups (always single-page).
querystring–Full-text search term, FTS5-matched against the dimension labels with prefix matching (e.g. "wheat", "import quantity"). Relevance-ranked.
NameTypeReqDescription
dimensionstring–The dimension resolved.
domainstring–The domain code echoed back.
errorobject–Present when the call failed. Absent on success.
matchesarray–Matching codes, relevance-ranked for query mode, else by code.
nextOffsetinteger–Offset to pass on the next call to fetch the following page. Present only when truncated is true; absent on the last page and for exact-code lookups.
noticestring–Guidance when nothing matched, more pages remain, or the dimension is not yet indexed.
totalMatchesnumber–Total matches in this domain before the result cap.
truncatedboolean–True when more matches remain beyond the returned page — fetch them with nextOffset.

No examples provided.

Install

How do I install the io.github.cyanheads/faostat-mcp-server server?

io.github.cyanheads/faostat-mcp-server is a hosted endpoint at https://faostat.caseyjhand.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · faostat.caseyjhand.com

# add to Claude Code
claude mcp add --transport http cyanheads-faostat-mcp-server 'https://faostat.caseyjhand.com/mcp'
Common questions

What is the io.github.cyanheads/faostat-mcp-server server?

io.github.cyanheads/faostat-mcp-server is listed in the public MCP registry as io.github.cyanheads/faostat-mcp-server. UN FAOSTAT global food & agriculture statistics over a local SQLite mirror, via MCP. This page covers its hosted endpoint (https://faostat.caseyjhand.com/mcp).

Is the io.github.cyanheads/faostat-mcp-server server safe to use?

io.github.cyanheads/faostat-mcp-server scores 88 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.cyanheads/faostat-mcp-server server expose?

io.github.cyanheads/faostat-mcp-server exposes 6 tools: faostat_list_domains, faostat_resolve_codes, faostat_query_observations, faostat_commodity_profile, faostat_dataframe_query, faostat_dataframe_describe. Their descriptions and schemas cost roughly 2,668 tokens of context every time the server is loaded.

Does the io.github.cyanheads/faostat-mcp-server server require authentication?

No. We connected to io.github.cyanheads/faostat-mcp-server without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the io.github.cyanheads/faostat-mcp-server server still maintained?

io.github.cyanheads/faostat-mcp-server is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.