open-signalsCAUTION
Public data signals with provenance and licence on every reading: source catalogue, fetchers, REST, MCP, GeoJSON layers
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Public data, ready for maps and agents. Every reading says where it came from, when it was fetched, and what licence it carries.
open-signals has three parts:
- A catalogue of public data sources (
catalog/sources.json). Each entry gives the API,
coverage, cadence, the key it needs and its licence. Weather, water, ice, hazards, flights, ships, satellites, energy, emissions, filings, trade and more. It's the list to check before writing yet another fetcher.
- Fetchers for the sources we read today. Each one turns an upstream answer into one shape,
the reading:
{ "id": "noaa-coops:9063085:2026-10-10", "at": "2026-10-10", "metric": "water_level",
"value": 2.762, "unit": "ft above LWD",
"summary": "Lake Erie at Toledo 2026-10-10: mean 2.76 ft above low water datum (...)",
"place": { "id": "coops-toledo", "name": "Lake Erie at Toledo", "lat": 41.6936, "lng": -83.4723 },
"fields": { "station": "9063085", "datum": "LWD", "readings": 155 },
"source": { "id": "noaa-coops", "name": "NOAA CO-OPS water levels", "url": "https://tidesandcurrents.noaa.gov/...",
"fetched_at": "2026-10-10T19:12:03Z", "license": "public_domain" } }- Ways in: a CLI, a REST API with an OpenAPI description, an MCP server for agents, and
GeoJSON map layers. There are no runtime dependencies; it needs Node 20 or later.
Use it
A public instance runs at https://open-signals.civops.io (REST under /v1, MCP at /mcp). It serves only public-domain and open sources, holds no upstream keys, and is rate-limited per IP. Try https://open-signals.civops.io/v1/layers/volcanoes?elevated=true.
git clone https://github.com/Civops-Platform/open-signals && cd open-signals # Node 20+, no npm install needed alias open-signals='node bin/open-signals.mjs' open-signals sources fires # search the catalogue open-signals sources --topic water --fetchable open-signals fetch usgs-earthquake
f86936fb5940OBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add open-signals -- npx -y [email protected]
{
"mcpServers": {
"open-signals": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (9)
9 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
get_dataset_part | read | The URL of one part of a dataset as GeoJSON, plus its description. Fetch the URL for the features; parts can be several megabytes. |
get_layer | read | One map layer as a GeoJSON FeatureCollection: one point per place with the reading on the date (else the latest observed before it, never a guess), or one point per event for event layers. |
get_readings | read | Fetch current readings from one source, each with value, unit, a one-line summary, place and provenance (source, URL, fetch time, licence). Sources this server will not republish (non-commercial, restricted or unreviewed licence) answer with an error naming the licence. |
get_source | read | One catalogue entry in full. |
list_datasets | read | Static public datasets this server holds as GeoJSON (wildfire burn perimeters, public-land share by county, federal campgrounds, fire-weather stations), with source, licence, feature count and parts (one per state, or |
list_hubs | read | Projects and catalogues that collect sources (God\ |
list_layers | read | Map layers this server can draw as GeoJSON, with unit, source, licence, whether it is available here, and how to read it. |
list_places | read | Named places the fetchers read for, with their upstream ids (CO-OPS station, USGS gauge, eBird region) and tags. |
search_sources | read | Search the catalogue of public data sources (weather, water, hazards, flights, ships, energy, filings, trade, ...). Each entry gives the API, coverage, cadence, auth needed and licence. Use it to find where a kind of data comes from before writing a fetcher. |
Trust audit
CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (6 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (8)
const base = `http://127.0.0.1:${srv.address().port}`;streamable-http
if (!table) table = JSON.parse(readFileSync(new URL('../../catalog/zip-centroids.json', import.meta.url), 'utf8')).zcta;{ id: 'fire', label: 'Fire', kind: 'polygons', part_by: 'state', source: 'NIFC', license: 'public_domain', features: 1, parts: { OH: 'fire/OH.geojson', XX: '../../etc/passwd' } },const base = `http://127.0.0.1:${srv.address().port}`;const base = `http://127.0.0.1:${srv.address().port}`;const base = `http://127.0.0.1:${srv.address().port}/i3x/v1`;const base = `http://127.0.0.1:${srv.address().port}/i3x/v1`;Gates applied: no_behavioural_pass.
f86936fb5940full audit observations/trust-audit/mcp-server/civops-platform__open-signals.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | f86936fb5940 | CAUTION | B | 89 | first audit |
Questions
What is the open-signals MCP server?
Public data signals with provenance and licence on every reading: source catalogue, fetchers, REST, MCP, GeoJSON layers
What tools does open-signals expose?
9 in total: 9 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is open-signals safe to connect to an agent?
With care. The audit graded it B (89/100) and found 8 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does open-signals need?
No credential environment variables were found in its source, so it appears to need none.
How does open-signals run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as open-signals at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (f86936fb5940), read on 2026-10-10. The repository is watched and re-audited when it changes.