Atlas / MCP servers / pipeworx-io / mcp-pjm

mcp-pjmSAFE

mcp/pipeworx-io/mcp-pjm

Real-time electricity market data from PJM Interconnection, the largest US grid operator (13 states plus Washington DC, about 65 million people): wholesale power prices by node, electricity generation by fuel type, and the seven-day demand forecast.

Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
4 4r · 0w · 0d
Transport
stdio · streamable-http
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

PJM Interconnection market data via Data Miner 2 — real-time LMPs, generation by fuel type and the seven-day load forecast for the largest US grid operator (13 states + DC, ~65 million people, Illinois to New Jersey).

Part of Pipeworx — an MCP gateway connecting AI agents to 1683+ live data sources.

Tools

  • pjm_feeds(feed?, row_count?, start_row?) — list the Data Miner 2 feed catalog,

or fetch ANY feed by exact name (da_hrl_lmps, inst_load, ...). The escape hatch for the hundreds of PJM feeds without a dedicated tool here.

  • pjm_lmp_realtime(pnode_id?, pnode_name?, datetime_beginning_ept?, row_count?)

— five-minute real-time LMP with congestion and loss components.

  • pjm_load_forecast(forecast_area?, row_count?) — seven-day hourly load forecast

by transmission zone and RTO total.

  • pjm_generation_fuel_mix(fuel_type?, datetime_beginning_ept?, row_count?) — MW

and percentage of total by fuel type.

Auth

BYO only today. Ocp-Apim-Subscription-Key header (Azure API Management). Platform fallback env var — not provisioned: PLATFORM_PJM_KEY.

A key is free but requires registering an account at and subscribing that account to the Data Miner 2 product. Those are two steps: a registered key that is not subscribed to the feed is refused identically to no key at all, which is why the pack's 401 message names the subscription explicitly rather than just saying "bad key".

Until the key lands, every tool refuses with a message containing requires an API key, and the pack is marked byoExpected: true in workers/gateway/src/pack-manifest.json so the vendor-key ratchet does not fail the deploy. Drop `byoExpected` the day `PLATFORM_PJM_KEY` is provisioned.

Data sources

  • — the browser UI over the same feeds.
  • — the API. Documented envelope:

{ "totalRows": N, "items": [...], "links": [...] }

Read from source at commit bd7238c0fe4dOBSERVED · 2026-10-11
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add mcp-pjm -- npx -y @pipeworx/[email protected]
claude-desktop
{
  "mcpServers": {
    "mcp-pjm": {
      "command": "npx",
      "args": [
        "-y",
        "@pipeworx/[email protected]"
      ]
    }
  }
}
03

Exposed tools (4)

4 read · 0 write · 0 destructive.

ToolRiskDescription
pjm_feedsreadList the feeds published by PJM Data Miner 2 — the catalog of every market-data dataset PJM exposes (LMPs, load, generation, ancillary services, capacity, transmission). Returns each feed\
pjm_generation_fuel_mixreadPJM generation by fuel type — MW generated and percentage of total from coal, natural gas, nuclear, wind, solar, hydro, oil, storage and other, per published interval. Use for
pjm_lmp_realtimereadPJM real-time five-minute locational marginal prices (LMP $/MWh) by pricing node, with the total price and its congestion and marginal-loss components. PJM is the largest US grid operator (13 states + DC, ~65M people). Use for
pjm_load_forecastreadPJM seven-day load forecast — forecast electricity demand in MW by forecast area (each transmission zone plus the RTO total), hour by hour. Use for \
04

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (1 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (1)

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, tsx, typescript, @cloudflare/workers-types
Why it matters. 4 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha bd7238c0fe4dfull audit observations/trust-audit/mcp-server/pipeworx-io__mcp-pjm.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-11bd7238c0fe4dSAFEB89first audit
06

Questions

What is the mcp-pjm MCP server?

Real-time electricity market data from PJM Interconnection, the largest US grid operator (13 states plus Washington DC, about 65 million people): wholesale power prices by node, electricity generation by fuel type, and the seven-day demand forecast.

What tools does mcp-pjm expose?

4 in total: 4 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is mcp-pjm safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does mcp-pjm need?

No credential environment variables were found in its source, so it appears to need none.

How does mcp-pjm run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @pipeworx/mcp-pjm at 0.1.1.

How current is this page?

The grade is for one exact copy of the source (bd7238c0fe4d), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement