Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Nasa

NPM · @PIPEWORX/MCP-NASA · 2 COMPONENTS

NASA MCP — wraps NASA Open APIs (api.nasa.gov)

−2 this week 77 Trust /100

Last scanned (1 hour ago)

Scores higher than 55% of npm servers

Category Health and Science

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security100
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency71
  • Repository presence not verified: we could not reach the forge to check. This is a gap on our side, not a finding about the repository. View diagnostics → Unverified
  • Cryptographically verified build provenance (signed, bound to pipeworx-io/mcp-nasa). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 2 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability64
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 1990 tokens (~221/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management23
  • Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 9 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 −5
    • Provenance: pass → unverified ▼ security
  • 4 Nov 26 +16
    • Malware scan: unverified → pass ▲ security
  • 3 Nov 26 −15
    • Malware scan: pass → unverified ▼ security
    • Package version: 0.2.0 → 0.2.1 functional
  • 2 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

  • 31 Oct 26 +1
    • Security disclosure: unverified → fail ▼ functional
  • 29 Oct 26 79

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/@pipeworx/mcp-nasa@0.2.1

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo pipeworx-io/mcp-nasa
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/pipeworx-io/mcp-nasa/.github/workflows/publish.yml@refs/heads/main
Rekor log index 3655615448
Predicate type SLSA build provenance https://slsa.dev/provenance/v1
Subject digest sha512:0243e587c348cbc01ba1cbf4da19846a302c1a664ad054fc98553881f328b3f4c501e75f02852a125409d65082836946fbe11415d511700ba2b9c50fc

Background: How many MCP packages publish verified provenance →

Dependencies 0 packages
Packages resolved 0
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 9 exposed · ~1,939 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
donki_cme ~282

"Was there a coronal mass ejection this week?" / "is a CME heading for Earth?" — coronal mass ejections catalogued by NASA DONKI, the space-weather event database run by NASA's Community Coordinated Modeling Center. AUTHORITATIVE for CME occurrence and geometry: returns each eruption's start time, the instruments that saw it, the analysts' note describing the source region, and for analysed events the modelled speed in km/s, the direction (latitude/longitude on the solar disk), half-angle width and whether the analysis is the most accurate available. A CME is the thing that causes an aurora or a satellite drag event two or three days later, so speed plus direction is what says whether it will reach Earth.

NameTypeReqDescription
_apiKeystring–NASA API key (optional, defaults to DEMO_KEY)
end_datestring–End date YYYY-MM-DD (optional; defaults to today).
limitnumber–Max events to return (default 50, max 200).
min_speed_km_snumber–Only return CMEs whose best analysis measured at least this speed in km/s. ~500 is fast, ~1000+ is a major event.
start_datestring–Start date YYYY-MM-DD (optional; DONKI defaults to ~30 days ago).

No output schema declared.

No examples provided.

donki_geomagnetic_storms ~266

"Was there a geomagnetic storm?" / "will there be an aurora tonight?" / "how strong was the Kp index?" — geomagnetic storm events from NASA DONKI, each with the full series of observed Kp index readings and their timestamps. AUTHORITATIVE for whether Earth's magnetic field was actually disturbed, as opposed to whether a flare happened: Kp 5 is a minor storm, Kp 7 puts aurora over the northern US and northern Europe, Kp 8-9 is severe. Also returns the CMEs and shocks DONKI linked to each storm, so you can trace a storm back to the eruption that caused it.

NameTypeReqDescription
_apiKeystring–NASA API key (optional, defaults to DEMO_KEY)
end_datestring–End date YYYY-MM-DD (optional; defaults to today).
limitnumber–Max storms to return (default 50, max 200).
min_kpnumber–Only return storms whose peak observed Kp reached at least this value (5 = minor storm, 7 = strong, 9 = extreme).
start_datestring–Start date YYYY-MM-DD (optional; DONKI defaults to ~30 days ago).

No output schema declared.

No examples provided.

donki_notifications ~319

"What is the current space weather forecast?" — the alerts, watches, warnings and weekly summary reports NASA DONKI issues to spacecraft operators. This is the narrative layer over the event catalogues: a human forecaster's text saying what happened, what is expected and what the impact is. Filter by message type (alert, watch, warning, summary) or by event class (CME, flare, geomagnetic storm, SEP, radiation belt enhancement).

NameTypeReqDescription
_apiKeystring–NASA API key (optional, defaults to DEMO_KEY)
end_datestring–End date YYYY-MM-DD (optional; defaults to today).
include_bodyboolean–Include the full message text (default true). Set false for a compact index — these bodies are long.
limitnumber–Max messages to return (default 20, max 100).
message_typestring–Filter the returned rows by the DONKI messageType field: "Alert", "Watch", "Warning" or "Report". Applied after fetching.
start_datestring–Start date YYYY-MM-DD (optional; DONKI defaults to ~30 days ago).
typestring–Message class: "all" (default), "FLR" (flare), "SEP", "CME", "IPS" (interplanetary shock), "MPC" (magnetopause crossing), "GST" (geomagnetic storm), "RBE" (radiation belt enhancement), "report" (week…

No output schema declared.

No examples provided.

donki_solar_energetic_particles ~200

Solar energetic particle (SEP) events from NASA DONKI — bursts of high-energy protons arriving at Earth after a flare or CME. These are the events behind radiation warnings for polar airline routes, astronaut EVA holds and satellite single-event upsets. Returns the event time, the detecting instruments and energy channels (e.g. "GOES-P: SEISS >10 MeV"), and the flare or CME DONKI linked as the source.

NameTypeReqDescription
_apiKeystring–NASA API key (optional, defaults to DEMO_KEY)
end_datestring–End date YYYY-MM-DD (optional; defaults to today).
limitnumber–Max events to return (default 50, max 200).
start_datestring–Start date YYYY-MM-DD (optional; DONKI defaults to ~30 days ago). SEP events are rare — a year-wide window is often the right query.

No output schema declared.

No examples provided.

get_apod ~113

Get the NASA Astronomy Picture of the Day with explanation. Optionally specify a date. Example: get_apod({ date: "2024-01-15", _apiKey: "DEMO_KEY" })

NameTypeReqDescription
_apiKeystring–NASA API key (optional, defaults to DEMO_KEY — get a free key at api.nasa.gov)
datestring–Date in YYYY-MM-DD format (optional, defaults to today). Range: 1995-06-16 to today.

No output schema declared.

No examples provided.

get_asteroids ~132

Get near-Earth asteroids approaching within a date range (max 7 days). Returns size, velocity, and miss distance. Example: get_asteroids({ start_date: "2024-01-01", end_date: "2024-01-07", _apiKey: "DEMO_KEY" })

NameTypeReqDescription
_apiKeystring–NASA API key (optional, defaults to DEMO_KEY)
end_datestringyesEnd date in YYYY-MM-DD format (max 7 days after start)
start_datestringyesStart date in YYYY-MM-DD format

No output schema declared.

No examples provided.

get_mars_photos ~336

"Show me photos from the Mars rover" / "Perseverance images from sol 1000" / "latest pictures from Mars" — raw images from NASA's Perseverance rover (Mars 2020), straight off the mars.nasa.gov feed. Filter by Martian sol and by camera. Returns image URLs at four resolutions, the sol, the UTC and Mars-local capture times, and the camera instrument. Keyless. Covers Perseverance only — Curiosity, Opportunity and Spirit have no live public image feed. Example: get_mars_photos({ sol: 1000, camera: "NAVCAM_LEFT" })

NameTypeReqDescription
camerastring–Camera instrument, exact: "NAVCAM_LEFT", "NAVCAM_RIGHT", "FRONT_HAZCAM_LEFT_A", "FRONT_HAZCAM_RIGHT_A", "REAR_HAZCAM_LEFT", "REAR_HAZCAM_RIGHT", "MCZ_LEFT"/"MCZ_RIGHT" (Mastcam-Z), "SHERLOC_WATSON",…
limitnumber–Max images to return (default 20, max 100).
solnumber–Martian sol (mission day) to retrieve images from, e.g. 1000. Perseverance landed on sol 0 (2021-02-18) and is past sol 1900. Omit for the most recent images.

No output schema declared.

No examples provided.

get_solar_flares ~143

Get recent solar flare events from NASA DONKI space-weather data. Returns each flare's class (e.g. C4.0, M1.8, X1.2), begin/peak/end times, source region, and active region number. Use for "recent solar flares", "is there solar activity / a solar storm", space-weather questions.

NameTypeReqDescription
_apiKeystring–NASA API key (optional, defaults to DEMO_KEY)
end_datestring–End date YYYY-MM-DD (optional; default today).
start_datestring–Start date YYYY-MM-DD (optional; default ~30 days ago).

No output schema declared.

No examples provided.

search_nasa_images ~148

Search the NASA Image and Video Library for images/videos of any subject — planets, missions, astronauts, launches, galaxies, etc. PREFER for "NASA photos of Jupiter", "images of the Apollo 11 mission", "pictures of a nebula". Returns title, description, date, NASA ID, media type, and a thumbnail URL. Keyless.

NameTypeReqDescription
limitnumber–Max results to return (default 10, max 50).
media_typestring–Optional filter: "image", "video", or "audio".
querystringyesSearch terms, e.g. "jupiter", "apollo 11", "crab nebula".

No output schema declared.

No examples provided.

Install

How do I install the Nasa MCP server?

Nasa runs locally as an npm package, launched with npx -y @pipeworx/mcp-nasa. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @pipeworx/mcp-nasa

# add to Claude Code
claude mcp add pipeworx-io-nasa -- npx -y @pipeworx/mcp-nasa
Common questions

What is the Nasa MCP server?

Nasa is an MCP server listed in the public MCP registry as io.github.pipeworx-io/nasa. NASA MCP, wraps NASA Open APIs (api.nasa.gov). This page covers its npm package (@pipeworx/mcp-nasa).

Is the Nasa MCP server safe to use?

Nasa scores 77 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Nasa MCP server expose?

Nasa exposes 9 tools: get_apod, get_asteroids, get_mars_photos, search_nasa_images, get_solar_flares, and 4 more. Their descriptions and schemas cost roughly 1,939 tokens of context every time the server is loaded.

Is the Nasa MCP server still maintained?

Nasa is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Nasa MCP server under?

Nasa declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.