nara-catalog-mcpSAFE
MCP server for genealogical research in the US National Archives Catalog: search records, read OCR text and citizen transcriptions, browse the hierarchy, and download page images.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/ianderso/nara-catalog-mcp/actions/workflows/ci.yml) [](https://pypi.org/project/nara-catalog-mcp/)
An MCP server for genealogical research in the US National Archives Catalog. Find an ancestor's pension file, service record or census page, read what machines and volunteers have transcribed from it, and fetch the page images you will cite. It also searches NARA's Access to Archival Databases (AAD), which the Catalog cannot reach: the NUMIDENT's Social Security applications and deaths, the WWII Army enlistment cards, and the 1820–1912 ship passenger lists among them.
It works the way a careful genealogist does. A catalogue description is a finding aid, and OCR text, transcriptions and tags are somebody else's reading of the page: all of them are leads. The page image is the source. The tools say which is which, and the server tells the model to read the image before citing it.
Nothing here writes to the Catalog, and nothing here keeps a family tree. The server finds and reads records; what you conclude from them belongs in your genealogy software, or in a family-tree MCP server running alongside this one.
The tools work on any record the Catalog describes, so a historian or a journalist can use them too. The examples throughout are about tracing people.
This is an independent project. It is not affiliated with, endorsed by, or supported by the National Archives and Records Administration.
Tools
The server publishes 21 tools. Twenty only read, and are annotated read-only for the client. One, download_page_image, writes a new file to local disk; it never overwrites one.
Finding a record
a8b52e52ba28OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add nara-catalog-mcp --env NARA_API_KEY=${NARA_API_KEY} -- uvx nara-catalog-mcp==1.1.0Exposed tools (2)
2 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
get_online_availability | read | List where else this record is available online. |
get_partner_digital_objects | read | List digital object ids a partner has matched to this record. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (1)
out = await call_tool(tool_name, naid="../../users/userId/7")
Gates applied: no_behavioural_pass.
a8b52e52ba28full audit observations/trust-audit/mcp-server/ianderso__nara-catalog-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | a8b52e52ba28 | SAFE | B | 89 | first audit |
Questions
What is the nara-catalog-mcp MCP server?
MCP server for genealogical research in the US National Archives Catalog: search records, read OCR text and citizen transcriptions, browse the hierarchy, and download page images.
What tools does nara-catalog-mcp expose?
2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is nara-catalog-mcp safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does nara-catalog-mcp need?
It reads NARA_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does nara-catalog-mcp run?
It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as nara-catalog-mcp.
How current is this page?
The grade is for one exact copy of the source (a8b52e52ba28), read on 2026-10-11. The repository is watched and re-audited when it changes.