Atlas / MCP servers / lostnumber07 / lostnumber07-shearline

lostnumber07-shearlineCAUTION

mcp/lostnumber07/shearline

Analyst-grade US severe weather: warnings, SPC outlooks, RAP environment, MRMS, GLM lightning

Verdict
CAUTION
Grade
B
Trust score
87 /100
Exposed tools
—
Transport
stdio · streamable-http
License
MIT
Stars
1
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://pypi.org/project/shearline/) [](https://pypi.org/project/shearline/) [](https://github.com/lostnumber07/shearline/actions/workflows/ci.yml) [](https://registry.modelcontextprotocol.io/v0.1/servers?search=shearline) [](LICENSE)

The severe-weather analyst your agent doesn't have. SHEARLINE is a free, MIT-licensed MCP server that gives AI agents analyst-grade US severe-weather tools: live warning polygons with Impact-Based Warning tags, SPC convective outlooks, RAP-derived point environments and forecast trends (CAPE/shear/SRH/STP computed with MetPy), MRMS radar-derived hail and rotation products, GOES lightning, ground-truth storm reports (real-time and historical), and a composite threat brief that synthesizes all of it. A dozen weather MCPs already wrap the basic forecast API; SHEARLINE deliberately skips everything they do and ships only what requires radar meteorology to expose correctly.

Informational only. Not a substitute for official NWS warnings. Every tool repeats this, because it matters: when weather threatens, follow official warnings from weather.gov and local authorities.

Tools

Read from source at commit 242dbe5963a1OBSERVED · 2026-10-10
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code (pypi)
claude mcp add shearline -- uvx shearline==1.1.0
03

Trust audit

CAUTIONgrade B · trust 87/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (7 observation(s))
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (11)

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
scripts/launch.command:10
URL="http://127.0.0.1:${PORT}/mcp"
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
scripts/smoke.py:56
url = f"http://127.0.0.1:{sys.argv[1] if len(sys.argv) > 1 else '8741'}/mcp"
LOWInventory / provenance · inv.binary · CWE-1104
fixtures/goes_glm_lcfa_sample.nc
goes_glm_lcfa_sample.nc
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
fixtures/mrms_mesh_sample.grib2.gz
mrms_mesh_sample.grib2.gz
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
fixtures/mrms_rotationtrackml60min_sample.grib2.gz
mrms_rotationtrackml60min_sample.grib2.gz
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
fixtures/rap_subset_moore.grib2
rap_subset_moore.grib2
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
fixtures/rap_subset_okc_f03.grib2
rap_subset_okc_f03.grib2
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:90
# serves at http://127.0.0.1:8741/mcp
LOWInventory / provenance · mcp.no_tools_extracted · CWE-1104
server.json
Why it matters. the tool list is enumerated at runtime by tools/list, not declared in source
Fix. the page says so rather than showing an empty table
INFOInventory / provenance · inv.oversize · CWE-1104
fixtures/hrrr_subset_okc_f00.grib2
fixtures/hrrr_subset_okc_f00.grib2
Why it matters. 36576577 bytes not read
INFOPrompt injection · prompt.authority_framing · CWE-94, CWE-1427
fixtures/python_sdk_README.md:1661
For more control, you can use the low-level server implementation directly. This gives you full access to the protocol and allows you to customize every aspect of your server, including lifecycle mana

Gates applied: no_behavioural_pass.

Audited 2026-10-10 · audit v0.4.1 · source sha 242dbe5963a1full audit observations/trust-audit/mcp-server/lostnumber07__shearline.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-10242dbe5963a1CAUTIONB87first audit
05

Questions

What is the lostnumber07-shearline MCP server?

Analyst-grade US severe weather: warnings, SPC outlooks, RAP environment, MRMS, GLM lightning

Is lostnumber07-shearline safe to connect to an agent?

With care. The audit graded it B (87/100) and found 11 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does lostnumber07-shearline need?

No credential environment variables were found in its source, so it appears to need none.

How does lostnumber07-shearline run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as shearline.

How current is this page?

The grade is for one exact copy of the source (242dbe5963a1), read on 2026-10-10. The repository is watched and re-audited when it changes.

Advertisement