NOAA WW3 MCP Server
PYPI · WW3-MCP · SCANNED OCT 4
GFS-Wave (WAVEWATCH III) forecasts and NDBC buoy wave observations
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 1 of 40 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to oceanmodeling/ocean-mcp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 2 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability59
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 1483 tokens (~164/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage71
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 9 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
How do I install the NOAA WW3 MCP Server server?
NOAA WW3 MCP Server runs locally as a PyPI package, launched with uvx ww3-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · ww3-mcp
claude mcp add oceanmodeling-ww3-mcp -- uvx ww3-mcp
{
"mcpServers": {
"oceanmodeling-ww3-mcp": {
"command": "uvx",
"args": [
"ww3-mcp"
]
}
}
} {
"servers": {
"oceanmodeling-ww3-mcp": {
"command": "uvx",
"args": [
"ww3-mcp"
]
}
}
} codex mcp add oceanmodeling-ww3-mcp -- uvx ww3-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"oceanmodeling-ww3-mcp": {
"type": "local",
"command": [
"uvx",
"ww3-mcp"
],
"enabled": true
}
}
} openclaw mcp add oceanmodeling-ww3-mcp --command uvx --arg ww3-mcp
mcp_servers:
oceanmodeling-ww3-mcp:
command: "uvx"
args: ["ww3-mcp"] {
"McpServers": {
"oceanmodeling-ww3-mcp": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"ww3-mcp"
]
}
}
} assistant mcp add oceanmodeling-ww3-mcp -t stdio -c uvx -a ww3-mcp
{
"mcpServers": {
"oceanmodeling-ww3-mcp": {
"command": "uvx",
"args": [
"ww3-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 1 Oct 26 61
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Oct 2026 · Analysed pypi/ww3-mcp@0.1.2
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | pypi |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | oceanmodeling/ocean-mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/oceanmodeling/ocean-mcp/.github/workflows/publish.yml@refs/tags/ww3-mcp-v0.1.2 |
| Rekor log index | 3034674716 |
| Predicate type | PyPI publish attestation https://docs.pypi.org/attestations/publish/v1 |
| Subject digest | sha256:9f3e3a100e07b3b4435c89f411b1f3845693a05f21f51eb91e99e48b3d0b34c9 |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 40 packages
| Packages resolved | 40 |
|---|---|
| Stale | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
ww3_compare_forecast_with_buoy ~203
Compare GFS-Wave forecast with NDBC buoy observations. Fetches both the model forecast and buoy observations for wave height, aligns the time series, and computes validation statistics (bias, RMSE, MAE, peak error, correlation). Args: station_id: NDBC buoy station ID (e.g., '41025', '46042'). buoy_lat: Buoy latitude in decimal degrees. buoy_lon: Buoy longitude in decimal degrees. grid: Wave grid to use (default: 'global.0p25'). hours_to_compare: Hours of comparison (default 24, max 120). response_format: 'markdown' (default) or 'json'.
| Name | Type | Req | Description |
|---|---|---|---|
| buoy_lat | number | yes | – |
| buoy_lon | number | yes | – |
| grid | – | – | – |
| hours_to_compare | integer | – | – |
| response_format | string | – | – |
| station_id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
ww3_find_buoys ~155
Find NDBC buoys near a geographic location. Searches the NDBC active stations registry for buoys within a specified radius of a lat/lon point. Returns station IDs, distances, and metadata. Args: latitude: Target latitude in decimal degrees. longitude: Target longitude in decimal degrees. radius_km: Search radius in kilometers (default 200). limit: Maximum number of buoys to return (default 10). response_format: 'markdown' (default) or 'json'.
| Name | Type | Req | Description |
|---|---|---|---|
| latitude | number | yes | – |
| limit | integer | – | – |
| longitude | number | yes | – |
| radius_km | number | – | – |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
ww3_get_buoy_history ~148
Get historical annual wave observations from an NDBC buoy. Fetches archived standard meteorological data for a specific year from the NDBC historical archive. Useful for climatological analysis. Args: station_id: NDBC station ID (e.g., '41025', '46042'). year: Year to fetch (e.g., 2023). max_records: Maximum records to return (default 500, max 5000). response_format: 'markdown' (default) or 'json'.
| Name | Type | Req | Description |
|---|---|---|---|
| max_records | integer | – | – |
| response_format | string | – | – |
| station_id | string | yes | – |
| year | integer | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
ww3_get_buoy_observations ~150
Get recent wave observations from an NDBC buoy. Fetches realtime standard meteorological data from NDBC including wave height, dominant period, average period, mean wave direction, wind speed, and wind direction. Data covers the last ~45 days at hourly intervals. Args: station_id: NDBC station ID (e.g., '41025', '46042', '44013'). hours: Number of recent hours to return (default 24, max 1080). response_format: 'markdown' (default) or 'json'.
| Name | Type | Req | Description |
|---|---|---|---|
| hours | integer | – | – |
| response_format | string | – | – |
| station_id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
ww3_get_forecast_at_point ~250
Get GFS-Wave forecast time series at a geographic point. Downloads subsetted GRIB2 data from NOMADS for multiple forecast hours and extracts wave variables at the nearest grid point. This is the primary tool for wave forecast data. Args: latitude: Target latitude in decimal degrees (-90 to 90). longitude: Target longitude in decimal degrees (-180 to 180). grid: Wave grid to use (default: 'global.0p25'). variables: List of wave variables to retrieve (e.g., ['HTSGW', 'PERPW', 'DIRPW']). Default: ['HTSGW', 'PERPW', 'DIRPW']. max_hours: Maximum forecast hours to retrieve (default 120, max 384). step_hours: Hours between forecast steps (default 3, min 1). response_format: 'markdown' (default) or 'json'.
| Name | Type | Req | Description |
|---|---|---|---|
| grid | – | – | – |
| latitude | number | yes | – |
| longitude | number | yes | – |
| max_hours | integer | – | – |
| response_format | string | – | – |
| step_hours | integer | – | – |
| variables | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
ww3_get_point_snapshot ~171
Get all wave variables at a single point and forecast time. Downloads a single GRIB2 file and extracts all available wave variables at the nearest grid point. Use this for a quick snapshot of current or near-future conditions. Args: latitude: Target latitude in decimal degrees. longitude: Target longitude in decimal degrees. forecast_hour: Forecast hour (0=analysis, 6, 12, ..., max 384). Default: 0. grid: Wave grid to use (default: 'global.0p25'). response_format: 'markdown' (default) or 'json'.
| Name | Type | Req | Description |
|---|---|---|---|
| forecast_hour | integer | – | – |
| grid | – | – | – |
| latitude | number | yes | – |
| longitude | number | yes | – |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
ww3_get_regional_summary ~192
Get spatial statistics for wave variables over a bounding box. Downloads a single GRIB2 file subsetted to the bounding box and computes min, max, mean, and standard deviation for each wave variable. Args: lat_min: Southern latitude bound. lat_max: Northern latitude bound. lon_min: Western longitude bound (-180 to 180). lon_max: Eastern longitude bound (-180 to 180). forecast_hour: Forecast hour (default 0). grid: Wave grid to use (default: 'global.0p25'). response_format: 'markdown' (default) or 'json'.
| Name | Type | Req | Description |
|---|---|---|---|
| forecast_hour | integer | – | – |
| grid | – | – | – |
| lat_max | number | yes | – |
| lat_min | number | yes | – |
| lon_max | number | yes | – |
| lon_min | number | yes | – |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
ww3_list_cycles ~126
Check available GFS-Wave forecast cycles on NOAA servers. Checks AWS S3 for available GRIB2 files to determine which forecast cycles have been published. Useful before calling ww3_get_forecast_at_point. Args: grid: Wave grid to check (default: 'global.0p25'). date: Specific date in YYYY-MM-DD format. Default: today UTC. num_days: Number of past days to check (1-7). Default: 2.
| Name | Type | Req | Description |
|---|---|---|---|
| date | – | – | – |
| grid | – | – | – |
| num_days | integer | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
ww3_list_grids ~88
List available GFS-Wave (WAVEWATCH III) model grids with resolution and domain info. Returns grid IDs, resolution, geographic coverage, forecast length, and available wave variables. Use this to choose a grid for ww3_get_forecast_at_point. Args: response_format: 'markdown' (default) or 'json'.
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
What is the NOAA WW3 MCP Server server?
NOAA WW3 MCP Server is listed in the public MCP registry as io.github.oceanmodeling/ww3-mcp. GFS-Wave (WAVEWATCH III) forecasts and NDBC buoy wave observations. This page covers its PyPI package (ww3-mcp).
Is the NOAA WW3 MCP Server server safe to use?
NOAA WW3 MCP Server scores 76 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 October 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the NOAA WW3 MCP Server server expose?
NOAA WW3 MCP Server exposes 9 tools: ww3_get_buoy_observations, ww3_get_buoy_history, ww3_list_grids, ww3_list_cycles, ww3_find_buoys, and 4 more. Their descriptions and schemas cost roughly 1,483 tokens of context every time the server is loaded.
Is the NOAA WW3 MCP Server server still maintained?
NOAA WW3 MCP Server is still listed as active in the MCP registry. We last reached this channel on 4 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the NOAA WW3 MCP Server server under?
NOAA WW3 MCP Server declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.