Atlas / MCP servers / plugrail / plugrail-jp-calendar

plugrail-jp-calendarSAFE

mcp/plugrail/servers

Japanese holiday and business-day calculations using official Japan Cabinet Office data.

Verdict
SAFE
Grade
B
Trust score
85 /100
Exposed tools
4 3r · 1w · 0d
Transport
streamable-http
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](LICENSE) [](https://modelcontextprotocol.io/)

A collection of MCP servers that connect to Japanese public data. The name alone does not describe the project, so plugrail is not related to railways or railway services.

Live servers

Connect

See the jp-calendar connection guide.

Self-hosting

  1. In packages/servers/jp-calendar/, copy wrangler.example.jsonc to wrangler.jsonc and fill in your Cloudflare resource IDs.
  2. Create the D1 database and KV namespace referenced by that configuration.
  3. Run pnpm --filter @plugrail/jp-calendar deploy.

The self-hosted server runs independently. Authentication, rate limiting, and usage metering are features of the hosted service only.

Architecture

MCP client
|
v
jp-calendar Worker --> Cloudflare D1 (holiday data)
--> Cloudflare KV (cached data)

Sources and disclaimer

This is not an official service of the National Tax Agency, the Digital Agency, or any other Japanese government body. Information provided does not represent their official views and is not guaranteed by them.

Source: Adapted from the Cabinet Office "National Holidays" page (https://www8.cao.go.jp/chosei/shukujitsu/gaiyou.html)

Contributing

Issues and pull requests are welcome. Please include enough context to reproduce a problem or explain a proposed change.

License

MIT. See LICENSE.

Read from source at commit 675e654e3e1dOBSERVED · 2026-10-11
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add jp-calendar --env ADMIN_TOKEN=${ADMIN_TOKEN} -- npx -y @plugrail/[email protected]
claude-desktop
{
  "mcpServers": {
    "jp-calendar": {
      "command": "npx",
      "args": [
        "-y",
        "@plugrail/[email protected]"
      ],
      "env": {
        "ADMIN_TOKEN": "${ADMIN_TOKEN}"
      }
    }
  }
}
03

Exposed tools (4)

3 read · 1 write · 0 destructive.

ToolRiskDescription
add_business_dayswrite指定した日付(date)の翌日から数えてN営業日目(days)の日付を返します。dateの当日は数えません。
business_days_betweenreadfrom〜to間の営業日数を数えます。既定では「fromを含まず、toを含む」境界です
is_holidayread指定した日付が日本の祝日(国民の祝日・休日)かどうかを判定します。内閣府公表データに基づきます。
list_holidaysread指定した年または期間の日本の祝日一覧を返します。
04

Trust audit

SAFEgrade B · trust 85/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (6 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (17)

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
packages/servers/jp-calendar/scripts/ingest-local.mjs:23
const BASE_URL = process.env.WRANGLER_DEV_URL ?? "http://127.0.0.1:8787";
LOWInventory / provenance · inv.hidden_file · CWE-1104
packages/servers/jp-calendar/.dev.vars.example
.dev.vars.example
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/servers/jp-calendar/test/ingest/admin-route.test.ts:3
import { handleAdminIngest } from "../../src/ingest/admin-route.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/servers/jp-calendar/test/ingest/csv.test.ts:2
import { parseCsv, toIsoDate } from "../../src/ingest/csv.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/servers/jp-calendar/test/ingest/diff.test.ts:2
import { diffHolidays, isEmptyDiff } from "../../src/ingest/diff.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/servers/jp-calendar/test/ingest/fetch-mock.ts:5
import { CAO_CSV_URL } from "../../src/ingest/fetch-source.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/servers/jp-calendar/test/ingest/notify.test.ts:3
import { notify } from "../../src/ingest/notify.js";
LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
packages/servers/jp-calendar/test/fixtures/holiday-csv.ts:20
"jZGWr4LMj2qT+oFFi3iT+oyOk/osjZGWr4LMj2qT+oFFi3iT+pa8j8wNCjE5NTUvMS8xLIyzk/oNCjE5NTUvMS8xNSyQrJBsgsyT+g0KMTk1NS8zLzIxLI90laqCzJP6DQoxOTU1LzQvMjksk1aNY5JhkLaT+g0KMTk1NS81LzMsjJuWQItMlE+T+g0KMTk1NS81LzU
LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
packages/servers/jp-calendar/test/fixtures/holiday-csv.ts:22
"jZGWr4LMj2qT+oFFi3iT+oyOk/osjZGWr4LMj2qT+oFFi3iT+pa8j8wNCjE5NTUvMS8xLIyzk/oNCjE5NTUvMS8xNSyQrJBsgsyT+g0KMTk1NS8zLzIxLI90laqCzJP6DQoxOTU1LzQvMjksk1aNY5JhkLaT+g0KMTk1NS81LzMsjJuWQItMlE+T+g0KMTk1NS81LzU
LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
packages/servers/jp-calendar/test/fixtures/holiday-csv.ts:24
"jZGWr4LMj2qT+oFFi3iT+oyOk/osjZGWr4LMj2qT+oFFi3iT+pa8j8wNCjE5NTUvMS8xLIyzk/oNCjE5NTUvMS8xNSyQrJBsgsyT+g0KMTk1NS8zLzIxLI90laqCzJP6DQoxOTU1LzQvMjksk1aNY5JhkLaT+g0KMTk1NS81LzMsjJuWQItMlE+T+g0KMTk1NS81LzU
LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
packages/servers/jp-calendar/test/fixtures/holiday-csv.ts:26
"jZGWr4LMj2qT+oFFi3iT+oyOk/osjZGWr4LMj2qT+oFFi3iT+pa8j8wNCjE5NTUvMS8xLIyzk/oNCjE5NTUvMS8xNSyQrJBsgsyT+g0KMTk1NS8zLzIxLI90laqCzJP6DQoxOTU1LzEzLzk5LJNWjWOSYZC2k/oKMTk1NS81LzMsjJuWQItMlE+T+g0KMTk1NS81LzU
LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
packages/servers/jp-calendar/test/fixtures/holiday-csv.ts:28
"jZGWr4LMj2qT+oFFi3iT+oyOk/osjZGWr4LMj2qT+oFFi3iT+pa8j8wNCjE5NTUvMS8xLIyzk/oNCjE5NTUvMS8xNSyQrJBsgsyT+g0KMTk1NS8zLzIxLI90laqCzJP6DQoxOTAwLzQvMjksk1aNY5JhkLaT+goxOTU1LzUvMyyMm5ZAi0yUT5P6DQoxOTU1LzUvNSy
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
packages/servers/jp-calendar/test/fixtures/holiday-csv.ts:35
const binary = atob(FIXTURES_BASE64[key]);
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
packages/servers/jp-calendar/test/fixtures/snapshot.ts:21
const binary = atob(env.TEST_SNAPSHOT_CSV_BASE64);
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
typescript
Why it matters. 1 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
packages/core/package.json
@cloudflare/workers-types, typescript
Why it matters. 2 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
packages/servers/jp-calendar/package.json
@cloudflare/workers-types, @types/node, typescript
Why it matters. 3 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 675e654e3e1dfull audit observations/trust-audit/mcp-server/plugrail__servers.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-11675e654e3e1dSAFEB85first audit
06

Questions

What is the plugrail-jp-calendar MCP server?

Japanese holiday and business-day calculations using official Japan Cabinet Office data.

What tools does plugrail-jp-calendar expose?

4 in total: 3 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is plugrail-jp-calendar safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (85/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does plugrail-jp-calendar need?

It reads ADMIN_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does plugrail-jp-calendar run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @plugrail/jp-calendar at 0.0.0.

How current is this page?

The grade is for one exact copy of the source (675e654e3e1d), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement