Atlas / MCP servers / pipeworx-io / mcp-ofr-funding

mcp-ofr-fundingSAFE

mcp/pipeworx-io/mcp-ofr-funding

OFR Short-Term Funding Monitor API — data.financialresearch.gov/v1, keyless,

Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
4 4r · 0w · 0d
Transport
stdio · streamable-http
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The Office of Financial Research (US Treasury) Short-Term Funding Monitor API — collateral- and tenor-level US repo market rates/volumes (DVP, GCF, tri-party) and money-market-fund balance-sheet composition, neither of which FRED or the NY Fed Desk's own release carries.

Part of Pipeworx — an MCP gateway connecting AI agents to 1683+ live data sources.

Tools

  • ofr_repo_rates(collateral, tenor, measure, vintage, start_date, end_date, limit) — repo rates or volumes for one collateral segment (dvp/gcf/tri/triexfed) x tenor (overnight/term bucket/collateral-type split) x measure (rate/volume/outstanding).
  • ofr_mmf_holdings(category, start_date, end_date, limit) — monthly money-market-fund investment composition (repo by collateral/counterparty type, outright Treasuries/agencies, bank-related assets).
  • ofr_search_funding_series(query, dataset, limit) — name/mnemonic lookup across the full 206-series repo+mmf catalog (OFR has no live search endpoint).
  • ofr_funding_anomaly(mnemonic OR collateral/tenor/measure/vintage, window_days) — compares the latest observation to a trailing window and reports delta + z-score, stating the exact window used.

Auth

Keyless. No registration, no API key, no rate-limit headers observed.

Data sources

  • https://data.financialresearch.gov/v1/series/timeseries?mnemonic=... — the only live per-query route. Returns a bare [[date, value], ...] array for one mnemonic. Used by all four tools for every actual data point returned.
  • https://data.financialresearch.gov/v1/series/dataset?dataset=repo and ?dataset=mmf — bulk metadata+data dump (~9MB gzip'd, ~450KB for mmf) used ONCE (2026-09-23) to generate src/catalog.ts (mnemonic → human name → start date → frequency). Never called at request time; too large to fetch per call in a Worker, and would be a bulk mirror if it were. The actual VALUES this pack returns always come from the timeseries endpoint above, live, pe
Read from source at commit c48b1433bbe6OBSERVED · 2026-10-11
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add mcp-ofr-funding -- npx -y @pipeworx/[email protected]
claude-desktop
{
  "mcpServers": {
    "mcp-ofr-funding": {
      "command": "npx",
      "args": [
        "-y",
        "@pipeworx/[email protected]"
      ]
    }
  }
}
03

Exposed tools (4)

4 read · 0 write · 0 destructive.

ToolRiskDescription
ofr_funding_anomalyreadCompares the LATEST observation of a repo or MMF series to its trailing window (mean, stddev over the N observations before it) and reports the delta and z-score —
ofr_mmf_holdingsreadMoney market mutual fund investment composition, monthly, from OFR
ofr_repo_ratesreadUS repo market rates/volumes broken out by COLLATERAL segment (dvp = FICC DVP service, gcf = GCF Repo service, tri = tri-party, tri_ex_fed = tri-party excluding the Fed\
ofr_search_funding_seriesreadBrowse the full catalog of OFR repo-market and money-market-fund mnemonics by name (e.g.
04

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (1 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (1)

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, tsx, typescript, @cloudflare/workers-types
Why it matters. 4 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha c48b1433bbe6full audit observations/trust-audit/mcp-server/pipeworx-io__mcp-ofr-funding.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-11c48b1433bbe6SAFEB89first audit
06

Questions

What is the mcp-ofr-funding MCP server?

OFR Short-Term Funding Monitor API — data.financialresearch.gov/v1, keyless,

What tools does mcp-ofr-funding expose?

4 in total: 4 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is mcp-ofr-funding safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does mcp-ofr-funding need?

No credential environment variables were found in its source, so it appears to need none.

How does mcp-ofr-funding run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @pipeworx/mcp-ofr-funding at 0.1.1.

How current is this page?

The grade is for one exact copy of the source (c48b1433bbe6), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement