# io.github.iarfhlaith/gaff-check (npm · gaff-check)

Irish property due diligence for AI agents: planning, sold prices, radon, zoning, flood, BER.

- Trust score: 66/100 (medium)
- Change this week: +25
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `gaff-check`: 66/100 (this document), [markdown](https://verifymcp.io/servers/iarfhlaith-gaff-check/gaff-check.md), [page](https://verifymcp.io/servers/iarfhlaith-gaff-check/gaff-check)

## Channel facts

- Registry: `npm`
- Package: `gaff-check`
- Version: `0.1.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 22 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 61/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2729 tokens (~389/item across 7 items; 7 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add iarfhlaith-gaff-check -- npx -y gaff-check
```

### Codex

```bash
codex mcp add iarfhlaith-gaff-check -- npx -y gaff-check
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "iarfhlaith-gaff-check": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "gaff-check"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add iarfhlaith-gaff-check --command npx --arg -y --arg gaff-check
```

### Hermes

```yaml
mcp_servers:
  iarfhlaith-gaff-check:
    command: "npx"
    args: ["-y", "gaff-check"]
```

### Other

```json
{
  "mcpServers": {
    "iarfhlaith-gaff-check": {
      "command": "npx",
      "args": [
        "-y",
        "gaff-check"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 66, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 62, +45)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security improvement] Install scripts: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional] Licence: MIT

### 2026-07-31 (score 17, −24)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 41, +17)

- [functional improvement] Tool coverage: unverified → 100

### 2026-07-28 (score 24, −17)

- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 41)

First indexed and scored.

## MCP tools (7)

### `resolve_location` (~257 tokens)

Resolve a free-text Irish address or place name to geographic coordinates (WGS84 lat/lng), returning ranked candidate matches.

Use this first when the user gives an address, street, townland, or place name in Ireland, to confirm the correct location before calling other gaff-check tools — every candidate echoes its full resolved name so you (and the user) can sanity-check the match. If you already have exact lat/lng coordinates, you do not need this tool.

Geocoding uses OpenStreetMap Nominatim and is best-effort: rural addresses and new estates may match poorly, and Eircodes only resolve where OSM mappers happen to have added them (there is no licensed Eircode lookup — if the user has only an Eircode, ask for the address or an approximate location instead). The confidence score ranks candidates within one query; it is not an absolute probability. Coordinates are WGS84 decimal degrees.

Input parameters:

- `limit` (integer): Maximum number of candidate matches to return (1–10, default 5)
- `query` (string, required): Free-text Irish address or place name, e.g. '25 Fitzwilliam Square, Dublin 2' or 'Salthill, Galway'

### `planning_applications` (~393 tokens)

Find Irish planning applications near a location, from the National Planning Application Database (all 31 local authorities, coverage back to ~2010, updated on varying cadences).

Use this for property due diligence: pending or recent developments near a home (apartment blocks, roads, masts), extensions and attic conversions on the same street (precedents for what gets approved), and refusals that hint at site constraints. Returns per application: reference number, local authority, development description, address, status, decision with dates, distance in metres from the query point, and a link to the local authority's planning file where available.

Provide either lat/lng (WGS84) or a free-text address (geocoded via OpenStreetMap; the resolved location is echoed back — verify it matches before drawing conclusions). Dates are ISO YYYY-MM-DD. The 'decided'/'pending' filter is based on whether a decision date is recorded; raw status strings vary by local authority and are returned verbatim. Coordinates of some older applications are approximate, and update lag differs by authority — absence of results is not evidence that nothing is planned.

Input parameters:

- `address` (string): Free-text Irish address to geocode (used only if lat/lng absent).
- `lat` (number): Latitude (WGS84). Provide with lng, or use address instead.
- `limit` (integer): Maximum applications to return, newest first (default 50).
- `lng` (number): Longitude (WGS84). Provide with lat, or use address instead.
- `radius_m` (integer): Search radius in metres around the point (default 500, max 5000).
- `since` (string): Only applications received on/after this date (ISO YYYY-MM-DD).
- `status` (string): 'decided' = a decision date is recorded; 'pending' = none yet; 'all' = both.

### `sold_prices` (~559 tokens)

Look up actual sold prices of residential properties in Ireland from the official Property Price Register (PSRA), which records declared prices from stamp-duty filings since January 2010.

Use this to see what properties actually sold for near a property of interest: filter by county (required — the register is organised by county), a free-text address fragment (e.g. a street or estate name), an Eircode routing key (first 3 characters, e.g. 'D06' — only present on more recent records), a date range, and/or a price range. Returns per sale: date, declared price in EUR, address as recorded, Eircode where recorded, new vs second-hand, and flags for not-full-market-price and VAT-exclusive sales. Results are newest first.

Know the data's limits: addresses are free text typed from stamp-duty returns — spelling varies, many records lack Eircodes, and address matching is substring-based, so try street name alone before street + number. There is no floor area, so price-per-square-metre cannot be derived. Prices on new builds are often VAT-exclusive (flagged), and declared-price errors exist in the register. This tool reports records, not valuations. If the user has no county, ask them (or infer it from the address) before calling.

Input parameters:

- `address_query` (string): Case-insensitive substring to match against the recorded address, e.g. 'Fitzwilliam Square' or 'Gorey Hill'.
- `county` (string, required): Irish county, e.g. 'Dublin', 'Cork' (case-insensitive). One of: Carlow, Cavan, Clare, Cork, Donegal, Dublin, Galway, Kerry, Kildare, Kilkenny, Laois, Leitrim, Limerick, Longford, Louth, Mayo, Meath,…
- `date_from` (string): Earliest sale date, ISO YYYY-MM-DD (register starts 2010-01-01). Default: 2 years before date_to.
- `date_to` (string): Latest sale date, ISO YYYY-MM-DD. Default: today.
- `eircode_routing_key` (string): 3-character Eircode routing key, e.g. 'D06'. Matches only records that include an Eircode (mostly post-2022).
- `limit` (integer): Maximum sales to return, newest first (default 50).
- `max_price` (number): Maximum declared price in EUR.
- `min_price` (number): Minimum declared price in EUR.

### `radon_risk` (~309 tokens)

Get the EPA's radon risk classification for the area containing a location in Ireland.

Radon is a naturally occurring radioactive gas and the second biggest cause of lung cancer in Ireland after smoking. Use this during property due diligence to learn the area's banding from the EPA Radon Risk Map: the result echoes the EPA's own wording ("About 1 in N homes in this area is likely to have high radon levels", where N is 5, 10 or 20 — lower N means higher risk) plus a high_radon_area flag (true for the 1-in-5 and 1-in-10 bands, the ≥10% threshold Ireland uses to designate High Radon Areas, which carry legal testing duties for workplaces).

This is an area-level prediction from measurement and geological data — it is NOT a measurement of any specific home. The EPA's standing advice ships in every response: any home anywhere can have high radon regardless of banding, the only way to know is to test, and testing is cheap (~€50). Provide lat/lng (WGS84) or a free-text address (geocoded; resolved location echoed back).

Input parameters:

- `address` (string): Free-text Irish address to geocode (used only if lat/lng absent).
- `lat` (number): Latitude (WGS84). Provide with lng, or use address instead.
- `lng` (number): Longitude (WGS84). Provide with lat, or use address instead.

### `zoning` (~329 tokens)

Get the generalised land-use zoning for a location in Ireland, from the Myplan.ie composite of all current local authority development plans.

Use this in property due diligence to learn what the land is zoned for — residential, agricultural, open space, industrial, mixed use, etc. Zoning tells you what could be built there (or next door), whether a site has development potential, and whether a use is likely permissible. Returns the generalised zone type (standardised across authorities, e.g. 'Existing residential'), the local authority's own original zone label and objective text, the development plan name with its validity dates, and a link to plan documents where available.

Provide lat/lng (WGS84) or a free-text address (geocoded; resolved location echoed back). Important: generalised zoning is a standardised simplification that complements but does NOT replace the statutory development plan — zone boundaries are generalised, and specific objectives, conditions and designations (protected structures, flood zones, SACs) live in the written plan. Verify anything decision-critical against the local authority's plan via the link. Points on unzoned land (much of rural Ireland outside town plans) return no records; that means no zoning objective is mapped, not that development is impossible.

Input parameters:

- `address` (string): Free-text Irish address to geocode (used only if lat/lng absent).
- `lat` (number): Latitude (WGS84). Provide with lng, or use address instead.
- `lng` (number): Longitude (WGS84). Provide with lat, or use address instead.

### `flood_risk` (~422 tokens)

Check mapped flood context for a location in Ireland: groundwater flood probability (high/medium/low), maximum historic groundwater flooding, and observed winter 2015/2016 surface-water flooding, from Geological Survey Ireland's 1:20,000 mapping.

Use this in property due diligence. For each layer you get: whether the point itself lies inside a mapped extent (at_point), how many extents fall within the search radius, and the distance in metres to the nearest one. Groundwater flooding (turloughs, high water tables) is a distinct hazard from river or coastal flooding and matters especially in karst limestone areas of the west and midlands.

CRITICAL LIMITATION — this tool does NOT check river (fluvial) or coastal flood models. The OPW's national flood extent datasets are licensed CC-BY-NC-ND, which forbids serving derived query results, so results include unchecked entries for them pointing to the OPW's official viewer (floodinfo.ie) where the user can view all flood maps for the location. A property can be at serious river or coastal flood risk while showing nothing in this tool's results.

Never interpret empty results as "no flood risk": mapping is not exhaustive, pluvial (rain) flooding is not mapped at all, and the fluvial/coastal layers are not queried. Absence of a mapped extent means exactly that and no more. Provide lat/lng (WGS84) or a free-text address (geocoded; resolved location echoed back). Insurance decisions use different, private data — this tool says nothing about insurability.

Input parameters:

- `address` (string): Free-text Irish address to geocode (used only if lat/lng absent).
- `lat` (number): Latitude (WGS84). Provide with lng, or use address instead.
- `lng` (number): Longitude (WGS84). Provide with lat, or use address instead.
- `radius_m` (integer): Search radius in metres around the point (default 250, max 5000).

### `ber_context` (~460 tokens)

Get Building Energy Rating (BER) context for an area of Ireland: the distribution of BER grades (A1 best … G worst) among certified dwellings in a county or Dublin postal district, optionally narrowed to a construction era, plus current SEAI retrofit grant amounts.

Use this to answer "what energy rating is typical for a house of this age around here?" and "what upgrade grants exist?" during property due diligence. Data is CSO statistics aggregated from BER certificates published since 2009 — e.g. 1978-1999 houses in Co. Galway cluster around C/D, while 2015+ builds are overwhelmingly A-rated. Areas accepted: the 26 counties, the cities (Dublin/Cork/Galway/Limerick/Waterford), or Dublin postal districts ('Dublin 9', 'D6W'). Construction periods: 1700-1977, 1978-1999, 2000-2004, 2005-2009, 2010-2014, 2015-2019, 2020-2024, 2025-2029.

THIS TOOL CANNOT TELL YOU A SPECIFIC HOME'S BER — never present the area distribution as the property's rating. A home's actual BER is on its certificate: the seller/agent must provide it, or it can be looked up on SEAI's public register (link included in every response) with the BER number or MPRN. Note also the statistics' bias: only dwellings that needed a certificate (sold, rented, grant-aided, or new since 2009) are counted, so old housing stock that never transacted is under-represented and its true typical rating is likely worse than shown. Grant amounts are a static reference with a last-verified date — confirm on seai.ie before financial decisions.

Input parameters:

- `area` (string, required): County ('Galway', 'Co. Cork'), city ('Cork City', 'Galway City'), or Dublin postal district ('Dublin 9', 'D6W').
- `period_of_construction` (string): Optional construction era of the property, e.g. '1978-1999'. Omit for all eras combined.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/iarfhlaith-gaff-check/gaff-check#diagnostics

## Score history

- 2026-08-03: 66
- 2026-08-02: 62
- 2026-08-01: 17
- 2026-07-31: 17
- 2026-07-30: 41
- 2026-07-28: 24
- 2026-07-27: 41

## Links

- npm package: https://www.npmjs.com/package/gaff-check
- Socket report: https://socket.dev/npm/package/gaff-check
- Repository: https://github.com/iarfhlaith/gaff-check
- Changelog RSS feed: https://verifymcp.io/servers/iarfhlaith-gaff-check/gaff-check/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/iarfhlaith-gaff-check/gaff-check/changelog.json
- HTML version of this page: https://verifymcp.io/servers/iarfhlaith-gaff-check/gaff-check