iarfhlaith-gaff-checkSAFE
MCP server exposing Ireland's public property datasets (planning, sold prices, flood, radon, zoning, BER context) as tools for AI agents
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Due diligence on any Irish property, for AI agents.
gaff-check is an open-source MCP (Model Context Protocol) server that gives AI assistants — Claude, Cursor, ChatGPT, or any MCP-compatible agent — ground truth from Ireland's scattered public property datasets.
Ask your assistant:
"Should I bid on this bungalow in Killiney? Tell me everything I should worry about."
...and it can check, in one conversation:
- 🏗️ Planning applications near the property (that pending apartment block behind the back garden)
- 💶 Sold prices on the street and in the area (Property Price Register)
- 🌊 Flood risk (OPW / GSI flood mapping)
- ☢️ Radon risk (EPA radon risk areas)
- 🗺️ Zoning (Myplan generalised land-use zoning)
- ⚡ BER / energy rating context and retrofit grant signals
- 🚓 Recorded-crime context for the containing Garda sub-district — category counts and carefully qualified rates, never a safety score
All from official, public Irish datasets. No scraping of commercial listing sites. Records and clearly labelled derived context — never invented certainty.
Why
Buying (or renovating, or just being nosy about) a house in Ireland means trawling six-plus government websites, each with its own dreadful UX, none of which talk to each other. The data is public. The synthesis isn't. gaff-check is the glue: a single, boring, reliable tool layer so the reasoning can happen in your AI assistant.
What it is not
- Not a valuation engine. It returns records; your agent does the thinking.
- Not a Daft/MyHome scraper. Public state data only.
- Not a website. It's a utility that enhances tools you already use.
Quick start
gaff-check runs as a stdio MCP server and requires Node.js 20 or newer. Do not run npx -y gaff-check on its own: it will wait for an MCP client to send requests, so the terminal will appear to hang. Add it to your assistant instead; no API keys or separate packag
5e519db31e0fOBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add gaff-check -- npx -y [email protected]
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (8)
import { setCacheDir } from "../../src/cache/disk-cache.js";import { queryBerDistribution } from "../../src/sources/cso_ber.js";import { setCacheDir } from "../../src/cache/disk-cache.js";import { queryPlanningApplications } from "../../src/sources/npad.js";import { fetchYearCounty } from "../../src/sources/ppr.js";@modelcontextprotocol/sdk, zod, @types/node, tsx, typescript, vitest
`gaff-check` runs as a stdio MCP server and requires Node.js 20 or newer. Do not run `npx -y gaff-check` on its own: it will wait for an MCP client to send requests, so the terminal will appear to han
Gates applied: no_behavioural_pass.
5e519db31e0ffull audit observations/trust-audit/mcp-server/iarfhlaith__gaff-check.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 5e519db31e0f | SAFE | B | 89 | first audit |
Questions
What is the iarfhlaith-gaff-check MCP server?
MCP server exposing Ireland's public property datasets (planning, sold prices, flood, radon, zoning, BER context) as tools for AI agents
Is iarfhlaith-gaff-check safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does iarfhlaith-gaff-check need?
No credential environment variables were found in its source, so it appears to need none.
How does iarfhlaith-gaff-check run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as gaff-check at 0.2.0.
How current is this page?
The grade is for one exact copy of the source (5e519db31e0f), read on 2026-10-10. The repository is watched and re-audited when it changes.