# CREHQ Location Intelligence (npm · crehq-mcp-server)

CREHQ entity affiliation, brand, site, franchise, credit, and location-intelligence tools.

- Trust score: 68/100 (medium)
- Change this week: +23
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `mcp.crehq.com`: 39/100, [markdown](https://verifymcp.io/servers/groundroof-crehq-mcp-server/mcp.md), [page](https://verifymcp.io/servers/groundroof-crehq-mcp-server/mcp)
- npm · `crehq-mcp-server`: 68/100 (this document), [markdown](https://verifymcp.io/servers/groundroof-crehq-mcp-server/crehq-mcp-server.md), [page](https://verifymcp.io/servers/groundroof-crehq-mcp-server/crehq-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `crehq-mcp-server`
- Version: `0.1.7`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 22 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 71/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 4319 tokens (~130/item across 33 items; 33 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add groundroof-crehq-mcp-server -- npx -y crehq-mcp-server
```

### Codex

```bash
codex mcp add groundroof-crehq-mcp-server -- npx -y crehq-mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "groundroof-crehq-mcp-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "crehq-mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add groundroof-crehq-mcp-server --command npx --arg -y --arg crehq-mcp-server
```

### Hermes

```yaml
mcp_servers:
  groundroof-crehq-mcp-server:
    command: "npx"
    args: ["-y", "crehq-mcp-server"]
```

### Other

```json
{
  "mcpServers": {
    "groundroof-crehq-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "crehq-mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 68, +48)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] Dependency health: unverified → partial
- [functional] Licence: MIT

### 2026-08-01 (score 20, +14)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 6, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-30 (score 24, −21)

- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 45)

First indexed and scored.

## MCP tools (33)

### `crehq_request_upgrade` (~237 tokens)

Use this when the user asks CREHQ for data that is NOT included in the free sandbox: CREHQ Credit Signals / credit-intelligence profiles, ownership/sponsor/capital-structure/rating-history data, site-selection criteria, real-estate requirements, tenant requirements, franchise/FDD data, Item 19 financials, real-estate contacts, source provenance, event/change history, bulk dataset downloads, whitespace analysis, co-tenancy, site timeline, point-in-time occupancy, or higher limits. This returns a clear upgrade prompt and, for free sandbox keys, records the requested topic as a CREHQ paywall/upgrade-intent signal for follow-up. Do NOT tell the user CREHQ lacks credit signals, franchise/FDD, or site-selection data merely because the free footprint endpoint omits them.

Input parameters:

- `brand` (string): Optional brand slug/name involved in the request, e.g. 'taco-bell'.
- `question` (string): The user's original request or short summary.
- `requested_data` (string, required): The paid data category the user asked for, including credit signals, site-selection criteria or real-estate requirements.

### `crehq_resolve_entity_affiliation` (~286 tokens)

Resolve a public venue or business identity across hotels, restaurants, retail, healthcare, banks, auto dealers, EV charging, and other location categories. Use this when the user asks which chain or brand a venue belongs to, who operates or owns a location, or whether a venue is independent. Provide at least one of url, venue_name, or address; additional identity hints improve disambiguation. Returns affiliation_status (branded, independent, not_a_commercial_venue, or unresolved), canonical name, entity type, brand, operator, parent company, confidence, evidence, and checked time. Treat independent, not_a_commercial_venue, and unresolved as valid outcomes; never invent an affiliation beyond the returned evidence. If paid access is required, preserve the exact purchase_url and CREHQ intent_id for user-approved checkout, then install the newly emailed Pro key and reconnect before retrying.

Input parameters:

- `address` (string): Street address, city/region, and country when known.
- `session_id` (string): Optional stable caller session id for attribution and post-purchase retry.
- `source` (string): Optional non-secret source label. Defaults to mcp.
- `url` (string): Public venue/business website URL using http:// or https://.
- `venue_name` (string): Venue or business name, used alone or to disambiguate the URL.

### `crehq_companies_list` (~180 tokens)

List franchise & multi-unit brands (companies) tracked in CREHQ's canonical, multi-source government-verified location database — restaurants, retail, banks, auto dealers, healthcare, hotels, EV charging and more. Filter by category or expansion status to discover brands actively opening or closing units. Each record links to verified store counts, FDD financials, real-estate criteria, and decision-maker contacts. Paginated.

Input parameters:

- `category` (string): Filter by vertical/category slug, e.g. 'restaurant', 'bank', 'auto-dealer', 'ev-charging'.
- `expansion_status` (string): Filter brands by growth trajectory derived from location lifecycle data.
- `page` (number): Page number for cursor/offset pagination (default 1).
- `per_page` (number): Results per page (max 200, default 50).

### `crehq_companies_search` (~126 tokens)

Full-text search CREHQ's brand universe by name to resolve a company to its canonical CREHQ id. Handles messy/alias names (e.g. 'mcdonald-s' → McDonald's Corporation). ALWAYS use this first to get a company_id before calling company detail, credit signals, franchise/FDD, real-estate, contacts, occupancy, whitespace, or co-tenancy tools.

Input parameters:

- `per_page` (number): Results per page (max 200, default 50).
- `q` (string, required): Search term — brand or company name (partial OK).

### `crehq_company_get` (~85 tokens)

Get a single brand's canonical CREHQ profile: verified current location count, vertical/category, parent/ownership (incl. private-equity backing where known), geographic footprint summary, and verification trace. The authoritative, de-duplicated source-of-truth record for a brand.

Input parameters:

- `id` (string|number, required): CREHQ company id (from crehq_companies_search).

### `crehq_company_credit_signals` (~151 tokens)

PREMIUM CREDIT INTELLIGENCE — get CREHQ Credit Signals for a brand: ownership and parent/issuer context, PE sponsor data, rating history, capital structure, debt/maturity/covenant facts, unit-count trajectory, footprint status counts, and material events. Use this when the user asks about tenant credit, creditworthiness, lender diligence, leverage, ratings, sponsor ownership, or distress/health signals for a brand. Requires credit-intel access; if unavailable or scope-gated, use crehq_request_upgrade with requested_data='credit_signals' instead of saying CREHQ lacks the data.

Input parameters:

- `id` (string|number, required): CREHQ company id (from crehq_companies_search).

### `crehq_company_franchise` (~100 tokens)

Retrieve FDD (Franchise Disclosure Document)-derived financials for a brand: franchise fees, royalty rates, total initial investment ranges, and Item 19 financial performance representations where disclosed. Sourced and multi-source-verified from state franchise registries — the hard numbers an analyst, investor, or prospective franchisee needs to underwrite a concept.

Input parameters:

- `id` (string|number, required): CREHQ company id (from crehq_companies_search).

### `crehq_company_real_estate` (~127 tokens)

PREMIUM SITE-SELECTION DATA — get a brand's site-selection criteria and target real-estate profile: preferred site types, building/lot size, target geographies and trade areas, and expansion markets. Essential for landlords, brokers, and site-selectors who want to know what a tenant is looking for before pitching them space. If unavailable or scope-gated, use crehq_request_upgrade with requested_data='site_selection_criteria' instead of saying CREHQ lacks site requirements.

Input parameters:

- `id` (string|number, required): CREHQ company id (from crehq_companies_search).

### `crehq_company_contacts` (~78 tokens)

Get real-estate decision-maker contacts for a brand (development, site-selection, and franchising roles) compiled from public records and the brand's own disclosures. The shortcut from 'which brand is expanding' to 'who do I email'.

Input parameters:

- `id` (string|number, required): CREHQ company id (from crehq_companies_search).

### `crehq_locations_list` (~267 tokens)

List individual store/branch/site records, filterable by brand, US state, and category. Each location carries a stable entity_uid, geocoded address, open/closed status, and a multi-source verification trace. The raw, government-cross-checked footprint behind any brand. Free sandbox keys can use this as a bounded brand lookup. This footprint output does NOT include credit signals, ownership/rating history, capital structure, site-selection criteria, FDD/Item 19, or tenant-credit diligence; for those requests use the relevant premium tool if available, otherwise call crehq_request_upgrade with the matching requested_data value.

Input parameters:

- `brand` (string): Brand slug or name to filter by (e.g. 'planet-fitness').
- `category` (string): Vertical/category slug.
- `include_provenance` (boolean): For CREHQ Pro self-serve keys, include D2 provenance, source, confidence and first-observed fields. Free sandbox keys will return upgrade intent.
- `page` (number): Page number for cursor/offset pagination (default 1).
- `per_page` (number): Results per page (max 200, default 50).
- `state` (string): US state, 2-letter code or full name (e.g. 'TX').

### `crehq_purchased_datasets_list` (~102 tokens)

List dataset snapshots purchased by the owner of the connected CREHQ self-serve key. Use this before querying a buyer-owned dataset through MCP. It shows snapshot_as_of, hosted_access_until, whether hosted MCP querying is active, and whether the buyer still owns the file snapshot after hosted access expires.

Input parameters:

- `include_expired` (boolean): Include expired hosted-access snapshots. Defaults to true so the agent can explain owned-file vs hosted-MCP access.

### `crehq_intelligence_preview` (~135 tokens)

For CREHQ Pro self-serve keys, spend the key's one monthly controlled intelligence preview credit. Returns a bounded evidence frame for a tenant-credit, site-selection, co-tenancy, franchise, or monitoring question without exposing raw premium tables or redistribution rights. Free keys receive a 402 upgrade prompt; full enterprise keys should use the dedicated premium tools directly.

Input parameters:

- `brand` (string): Tenant/brand slug or name, e.g. 'family-dollar'.
- `preview_type` (string): Type of controlled intelligence preview. Defaults to credit_brief.
- `question` (string): Short user question to frame the preview.

### `crehq_purchased_dataset_locations` (~254 tokens)

Query rows from a dataset snapshot the connected key owner has purchased. This is for buyer-owned point-in-time snapshots, not live CREHQ refresh. The response includes snapshot_as_of, hosted_access_until, artifact basis, and row results. If hosted access expired, it returns an upgrade/update-plan message while acknowledging that the buyer still owns the original file snapshot.

Input parameters:

- `city` (string): Optional city filter.
- `country` (string): Optional 2-letter country filter.
- `dataset` (string): Purchased dataset slug, e.g. 'pilot-flying-j'.
- `lat` (number): Latitude for radius search.
- `lng` (number): Longitude for radius search.
- `page` (number): Page number for cursor/offset pagination (default 1).
- `per_page` (number): Results per page (max 200, default 50).
- `purchase_id` (number): Specific CREHQ purchase id from crehq_purchased_datasets_list.
- `q` (string): Optional text search across name/address/city/store id.
- `radius` (number): Radius in miles for lat/lng search, max 250.
- `state` (string): Optional 2-letter state filter.

### `crehq_location_get` (~69 tokens)

Get one location's full record by id: geocoded address, brand, lifecycle status, attributes (e.g. drive-thru, square footage, fuel/EV ports where applicable), and the sources that verify it exists.

Input parameters:

- `id` (string|number, required): CREHQ location id.

### `crehq_locations_search` (~118 tokens)

Search locations across multiple fields at once — name, brand, street address, city/state/geography. Use when you have a fuzzy description of a physical place rather than an id.

Input parameters:

- `address` (string): Street address fragment.
- `brand` (string): Brand slug/name.
- `city` (string): City name.
- `name` (string): Location or brand name fragment.
- `per_page` (number): Results per page (max 200, default 50).
- `state` (string): US state code or name.

### `crehq_locations_nearby` (~189 tokens)

Radius search: find all tracked locations within N miles of a lat/lng point. Powers trade-area analysis, competitor mapping, and 'what's near this address' questions. Returns distance-sorted, government-verified storefronts across every vertical CREHQ covers.

Input parameters:

- `brand` (string): Optional: restrict to one brand.
- `category` (string): Optional: restrict to one vertical/category.
- `include_provenance` (boolean): For CREHQ Pro self-serve keys, include D2 provenance, source, confidence and first-observed fields. Free sandbox keys will return upgrade intent.
- `lat` (number, required): Latitude (decimal degrees).
- `lng` (number, required): Longitude (decimal degrees).
- `per_page` (number): Results per page (max 200, default 50).
- `radius_mi` (number): Search radius in miles (default 5).

### `crehq_locations_bulk` (~134 tokens)

Bulk location retrieval for ETL/pipeline use: fetch many locations in one call by a list of ids, a list of brands, or a GeoJSON polygon (e.g. a custom market boundary). Use this instead of looping single-location calls when hydrating a dataset.

Input parameters:

- `brands` (array): List of brand slugs to pull all locations for.
- `ids` (array): Explicit list of location ids/entity_uids.
- `per_page` (number): Results per page (max 200, default 50).
- `polygon`: GeoJSON Polygon/MultiPolygon geometry; returns locations inside the boundary.

### `crehq_locations_events` (~124 tokens)

Pull the cross-brand location LIFECYCLE STREAM — openings, closings, relocations, ownership/brand changes — since a timestamp. The real-time expansion/contraction signal that drives prospecting, market-monitoring, and 'who's moving right now' alerts. Returns a next-since cursor for incremental polling.

Input parameters:

- `per_page` (number): Results per page (max 200, default 50).
- `since` (string, required): ISO-8601 timestamp; returns events on/after this time. Use the returned next_since_cursor for the next poll.

### `crehq_location_history` (~88 tokens)

Full append-only event log for ONE physical store/site (by entity_uid): every open/close/rebrand/attribute change CREHQ has recorded, with dates and sources. Time-series provenance for a single location.

Input parameters:

- `entity_uid` (string, required): Stable CREHQ entity_uid for the location.
- `limit` (number): Max events to return (default 200, max 1000).

### `crehq_company_changes` (~144 tokens)

Date-bounded feed of everything that changed for ONE brand's footprint — openings, closings, relocations, attribute edits — between two timestamps and optionally filtered by event type. The brand-scoped version of the lifecycle stream, ideal for monitoring a target account.

Input parameters:

- `id` (string|number, required): CREHQ company id.
- `limit` (number): Max events (default 500, max 5000).
- `since` (string): ISO-8601 start timestamp.
- `types` (string): Comma-separated event types to include (e.g. 'opened,closed,relocated').
- `until` (string): ISO-8601 end timestamp.

### `crehq_company_occupancy` (~134 tokens)

POINT-IN-TIME roster: reconstruct exactly which locations a brand operated on a given historical date. Answers 'how many units did this chain have on 2022-01-01 and where' — true historical footprint, not just today's count. Powers growth-curve and same-store analysis.

Input parameters:

- `date` (string): ISO date (YYYY-MM-DD) for the snapshot; omit for current.
- `id` (string|number, required): CREHQ company id.
- `limit` (number): Max rows (default 1000, max 10000).
- `offset` (number): Row offset for pagination.

### `crehq_site_timeline` (~110 tokens)

FLAGSHIP DIFFERENTIATOR — given a physical site (site_uid), return the full chronological tenancy history: every brand that has EVER occupied that address and when. Answers 'this was a Blockbuster, then a Sprint store, now a Chipotle.' Unmatched for backfill/teardown analysis, second-generation space, and landlord due diligence. No other location dataset reconstructs address-level succession like this.

Input parameters:

- `site_uid` (string, required): Stable CREHQ site_uid for the physical address.

### `crehq_whitespace` (~104 tokens)

PREMIUM INTELLIGENCE — whitespace analysis: postal codes/markets where a brand's competitors are present and performing but the brand itself is ABSENT. The ranked, data-driven shortlist of where a chain should expand next. Built on CREHQ's full multi-vertical, government-verified footprint. (Intel & Enterprise tiers.)

Input parameters:

- `company_id` (string|number, required): CREHQ company id to analyze.
- `country` (string): ISO country code (default 'US').

### `crehq_co_tenancy` (~108 tokens)

PREMIUM INTELLIGENCE — co-tenancy analysis: which brands most often co-locate within a given radius of this brand's stores (the chains that cluster together: e.g. who anchors near Chipotle). Drives site-selection, anchor-tenant matching, and trade-area benchmarking. (Intel & Enterprise tiers.)

Input parameters:

- `company_id` (string|number, required): CREHQ company id to analyze.
- `radius_meters` (number): Co-location radius in meters (default 200).

### `crehq_location_site_profile` (~90 tokens)

CREHQ Modeled Site Profile for one physical location: traffic/AADT, route class, trade-area demographics, radius demographics, drive-time context, nearby tenants, format signals, lifecycle timing, and provenance/coverage flags. This is CREHQ-modeled from observed location/context data, not a brand-stated requirement sheet.

Input parameters:

- `entity_id` (string|number, required): CREHQ location entity_id.

### `crehq_company_site_pattern` (~158 tokens)

CREHQ Modeled Site Pattern for a brand: empirical medians, ranges, percentiles, road-type mix, co-tenant mix, trade-area density, recent-opening context, and layer coverage/confidence. Use this to infer revealed-preference site patterns from where the brand actually operates. Do not present it as company-stated requirements unless the response includes stated-requirement provenance.

Input parameters:

- `company_id` (string|number, required): CREHQ company id to model.
- `country` (string): ISO country code filter (default 'US' where modeled context layers are available).
- `include_locations` (boolean): Include representative location rows in the response (default false).
- `limit` (number): Max representative rows when include_locations=true.

### `crehq_recent_location_context` (~175 tokens)

Context for a brand's most recently observed locations: event timing, address/market, traffic counts when backfilled, route class, trade-area demographics, radius demographics, drive-time context, and coverage flags. Useful for questions like 'traffic counts for the last 50 Starbucks locations CREHQ observed.' Event rows distinguish verified openings from first-observed/reconciliation events.

Input parameters:

- `company_id` (string|number, required): CREHQ company id.
- `country` (string): ISO country code filter (default all available rows).
- `event_type` (string): Lifecycle event type to use for recency (default first_observed).
- `limit` (number): Max locations to return (default 50, max 500).
- `only_with_traffic` (boolean): When true, return only recent rows with traffic/AADT attached.

### `crehq_datasets_list` (~130 tokens)

Browse CREHQ's catalog of packaged, ready-to-license datasets (whole-brand footprints, vertical rollups, FDD financials, etc.), filterable by category, country, and freshness. Each entry exposes row counts, schema, and refresh date — the menu of bulk data products.

Input parameters:

- `category` (string): Filter by category slug.
- `country` (string): ISO country code filter.
- `freshness` (string): Freshness filter (e.g. '30d', '90d').
- `per_page` (number): Results per page (max 200, default 50).

### `crehq_dataset_get` (~62 tokens)

Get full metadata for one dataset by slug: row count, column schema, coverage, verification methodology, last-refresh date, and licensing notes — everything needed to evaluate it before download.

Input parameters:

- `slug` (string, required): Dataset slug (from crehq_datasets_list).

### `crehq_dataset_download` (~77 tokens)

Download a licensed dataset by slug in your chosen format (CSV, JSON, GeoJSON, or XLSX). Requires a tier/contract that includes the dataset. Returns the raw payload (or a signed link) for direct ingestion.

Input parameters:

- `format` (string): Desired format (default json).
- `slug` (string, required): Dataset slug.

### `crehq_dataset_categories` (~33 tokens)

List all dataset categories with counts — a quick map of how CREHQ's data products are organized across verticals.

### `crehq_trends_company` (~62 tokens)

Time-series trends for ONE brand: outlet-count history, fee/royalty trends, and FDD financial trajectory over time. The growth/health curve of a concept in a single call.

Input parameters:

- `id` (string|number, required): CREHQ company id.

### `crehq_trends_geographic` (~82 tokens)

Geographic trend analysis: metro/state concentration and opening/closing velocity across CREHQ's footprint. Surfaces which markets are heating up or cooling down across brands and verticals.

Input parameters:

- `category` (string): Optional vertical/category filter.
- `country` (string): ISO country code (default 'US').
- `state` (string): Optional US state filter.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/groundroof-crehq-mcp-server/crehq-mcp-server#diagnostics

## Score history

- 2026-08-03: 68
- 2026-08-02: 68
- 2026-08-01: 20
- 2026-07-31: 6
- 2026-07-30: 24
- 2026-07-28: 45
- 2026-07-27: 45

## Links

- npm package: https://www.npmjs.com/package/crehq-mcp-server
- Socket report: https://socket.dev/npm/package/crehq-mcp-server
- Repository: https://github.com/groundroof/crehq-mcp-server
- Changelog RSS feed: https://verifymcp.io/servers/groundroof-crehq-mcp-server/crehq-mcp-server/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/groundroof-crehq-mcp-server/crehq-mcp-server/changelog.json
- HTML version of this page: https://verifymcp.io/servers/groundroof-crehq-mcp-server/crehq-mcp-server