Atlas / MCP servers / profullstack / NicheDB

NicheDBBLOCK

Name: NicheDB
Author: profullstack

mcp/profullstack/niche-db

MCP server by profullstack · Audited 2026-10-11

Sources in, feeds out. An open platform for ever-growing databases of real-time public data: web, RSS, API, CLI and MCP on one Postgres.

Verdict

BLOCK

Grade

Trust score

41 /100

Exposed tools

81 70r · 10w · 1d

Transport

—

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Sources in, feeds out. An open platform for databases that only ever grow: game releases, package registries, government filings, and any other public data with a big seed and daily growth. One Postgres, one Redis, and every row reachable by web, RSS, JSON, API, CLI and MCP.

The first deployment is nichedb.dev. Run your own on anything that has Postgres and Redis.

The model

Adapters are one file each in packages/adapters/src. One hundred and sixty-one ship today across forty-six collections:

Read from source at commit 1bd52be83eb2OBSERVED · 2026-10-11

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add queue --env COINPAY_API_KEY=${COINPAY_API_KEY} --env COINPAY_X402_KEY=${COINPAY_X402_KEY} --env EXTRA_WEBAUTHN_ORIGINS=${EXTRA_WEBAUTHN_ORIGINS} --env NICHEDB_KEY=${NICHEDB_KEY} -- npx -y @nichedb/[email protected]

claude-desktop

{
  "mcpServers": {
    "queue": {
      "command": "npx",
      "args": [
        "-y",
        "@nichedb/[email protected]"
      ],
      "env": {
        "COINPAY_API_KEY": "${COINPAY_API_KEY}",
        "COINPAY_X402_KEY": "${COINPAY_X402_KEY}",
        "EXTRA_WEBAUTHN_ORIGINS": "${EXTRA_WEBAUTHN_ORIGINS}",
        "NICHEDB_KEY": "${NICHEDB_KEY}"
      }
    }
  }
}

Exposed tools (81)

70 read · 10 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`Alerts`	read	Earthquakes and global disaster alerts, minutes after they are issued. Weather has a collection of its own.
`Algorithms`	read	A reference shelf of algorithms, data structures and methods, assembled from the open catalogues that carry them whole: every entry in NIST
`Automotive`	read	Every make, model and year sold in the US, what has gone wrong with each one, and everything known about one specific car from its VIN.
`Books`	read	New books as they are catalogued at Open Library, with covers, descriptions and subjects.
`Brakes`	read	Braking recalls and complaints across every manufacturer: hydraulic, air and parking brakes.
`Cars`	read	Cars, motorcycles, trucks, vans and RVs, as published under the OpenCar profile.
`Channels`	read	The whole iptv-org directory: 31,000 television channels worldwide with logo, country, language, category and network, and the public stream where one exists. What a player matches a playlist entry against.
`Chess`	read	Official tournaments relayed live on Lichess, one row per event and per round.
`Companies`	read	Companies the crawler could name, by domain, with industry and stack as topics.
`Countries`	read	Population and demography for every country.
`Courts`	read	Every court CourtListener knows, with its jurisdiction, citation string and dates.
`Crime`	read	Crime incident records, local police announcements, scanner directories and annual estimates. California police announcements use the publishing city’s reference point for geographic filters; their dates are publication times. Incident records retain their reported locations and times.
`Extensions`	write	New Firefox add-ons and VS Code extensions, with icons, categories and repo stats. MCP servers have a collection of their own.
`Filings`	read	SEC EDGAR filings as they land (Form D raises, insider trades, 8-K events) and Federal Register documents.
`Forums`	read	Posts from the house bulletin boards: every topic on tsbb.dev with its opening post, author and the forum it was posted in.
`Fundamentals`	read	Revenue, income, EPS, assets, cash and shares from every SEC filer’s XBRL facts, one item a company, walked weekly.
`GPipe`	read	Pipeline parallelism with 2048 x 2048 tiles on 8 devices
`Games`	read	Video game releases and what is coming, from the Steam store and IGDB. Follow a genre, a platform or a store category.
`Guests`	read	People with a Guest section: available to appear, their expertise, their terms.
`Hooks`	read	Hooks: what runs before and after a tool call, a prompt or a session. The ones the community ships, with install counts.
`Jobs`	read	The labour market as governments measure it: the US jobs report series from the BLS, harmonised unemployment and employment rates across Europe, and the WARN notices employers must file before a mass layoff — the one public, named record of jobs actually being cut.
`Judges`	read	Judges and other people in the CourtListener people database, with their positions.
`Layoffs`	read	WARN notices: the companies actually cutting jobs, named, counted and dated.
`Marketplace`	read	Asks and offers from the house marketplaces: what customers on d0rz.com and bl0ggers.com want done and what providers will do, each with its category, city and the budget or rate lifted out of the post.
`Markets`	read	Every market venue in the world from the ISO 10383 register, across 149 countries, and the events that move the ones we have data for: US dividends, splits, mergers and spin-offs, trading halts as they are declared, the market news wire, and the ECB’s daily euro reference rates.
`Music`	read	Upcoming album and single releases from MusicBrainz, with cover art, videos and artist pages.
`News`	read	The story and the screen: wire copy read straight from newsroom RSS, worldwide coverage from GDELT in 65 languages, and the live news channels you can actually watch, each with its public stream. Every source is free and keyless.
`NicheDB`	read	An open, ever-growing database of real-time public data: collections, sources, feeds and items, searchable and followable, over MCP.
`Outages`	read	Incidents from the status pages of the platforms developers depend on, as they are posted and resolved.
`Plugins`	read	Every plugin declared in a Claude Code marketplace manifest, the official one included: what it installs, who wrote it, its version and licence, and the command that adds the marketplace it comes from.
`Podcasters`	read	People with a Broadcast section: the show they host, its feed and what they are looking for.
`Property`	read	Houses, apartments, rooms and land, as published under the OpenProperty profile.
`SaaS`	read	Software products and listings from the house directories: every product on saasrow.com with its category, tags, pricing model, platforms, alternatives and the votes readers gave it.
`Screen`	read	Films, TV and anime: what is coming to cinemas, to rent, to a streaming service and to air, with posters, genres and IMDb ratings for 400,000 titles. The data genrewatch.com is built on.
`Setlists`	read	Past events with a setlist, on MusicBrainz or setlist.fm.
`Sites`	read	Domains the crawler read where the page named no organisation.
`Skills`	destructive	Agent skills you can drop into a project: the 890 claude-code-templates ships with their install counts, and the hand-picked ones from awesome-claude-code. One row per skill, with the command that installs it.
`Space`	read	Every upcoming rocket launch worldwide: net time, provider, pad, mission and webcast.
`Sports`	write	Every fixture across 17 sports and 350 leagues: schedule, live score, line, venue and broadcast, with the leagues and teams behind them, and tennis by tournament. The data tipoffwatch.com is built on, kept here so every site and player can read it.
`Subagents`	read	Subagents by the job they do, from the claude-code-templates catalogue and the community lists that name each one rather than the bundle it ships in. One row per subagent, with its category and the file that defines it.
`Tabletop`	read	Magic: The Gathering sets and the newest cards, with images, oracle text and prices.
`add_source`	write	Add a source: an adapter with a config, fetched on a schedule (needs a key; admins and Pro). Call list_adapters first for the fields.
`check_domain`	read	Is a domain name registered? Asks each registry over RDAP. Give
`claim_profile`	read	Claim a profile as the key owner (needs a key). Proven when the key owner’s email is one the profile lists, or when the person’s site or show page links back to the profile’s nichedb page. An admin may claim on behalf of an email.
`company-ticker`	read	The ticker and SEC CIK of the public company behind a provider, matched by name against the SEC’s registrant list. Says nothing for a private or non-US company.
`corpusdata`	read	A NOW Corpus lookup for the item title or primary term.
`create_feed`	write	Save a query as a feed (needs a key). Sources, kinds and tags narrow; q is a text match; upcoming keeps only future-dated items.
`developer`	read	The provider’s official CLI and the command that installs it, read off the vendor’s own guide or matched by domain in Homebrew, npm and the Terraform registry; plus its API docs, Terraform provider, status page and GitHub org.
`feed_items`	read	What a feed selects, newest first. Page with before_id.
`find_profile_by_linkedin`	read	The public profile a LinkedIn profile or company URL belongs to (linkedin.com/in/... or /company/...), or null. LinkedIn only: profiles are never looked up by email.
`follow_feed`	read	Follow a feed as the key owner (needs a key). Channels: webpush, email, webhook.
`get_item`	read	One item with its full adapter payload.
`get_profile`	read	One person by id,
`get_tld`	read	One top-level domain: type, registry, RDAP server, when it entered or left the root, every registrar price (register, renew, transfer, restore, promotions, privacy, restrictions) and its change history.
`github-repo`	write	Stars, topics, licence, language and last push of the linked repository.
`list_adapters`	write	Every adapter this deployment can run, with the config fields each takes. Use before add_source.
`list_collections`	read	The collections (niches) with their source, feed and item counts.
`list_enrichers`	read	Every enricher (YouTube videos, Wikipedia, repo stats, downloads, company profiles, TL;DRs) and which collections turn it on by default. Items carry their results under
`list_feeds`	read	Public feeds, most followed first. Optionally one collection.
`list_sources`	write	Sources with status, last run and item counts. Optionally one collection.
`llms.txt`	read	Collections, sources, feeds and every machine-readable endpoint, in one document.
`match_items`	read	Which title, channel or fixture is this name? Give a file name, a release name or a playlist entry (
`npm-stats`	read	Last week
`opengraph`	read	The linked page
`openlibrary-work`	read	The work
`population`	read	Population and demography, drilled down from the world to the ZIP code. Give a
`railway`	read	unofficial railway cli
`recent_items`	read	Newest items, optionally narrowed to a collection, source or kind.
`run_source`	write	Fetch a source now instead of waiting for its schedule (needs a key; owner or admin).
`search_items`	read	Full-text search over titles, summaries and tags. Use this first when you know a name.
`search_tlds`	read	Top-level domains: every label in IANA
`sec-company`	read	Ticker, exchange, industry (SIC), state and website of the filer, from EDGAR.
`semantic-scholar`	read	A one-sentence TL;DR, citation counts and an open-access PDF where Semantic Scholar has the paper.
`stats`	read	What this deployment holds: collections, sources, items, items added today, feeds.
`submit_feed`	write	Suggest an RSS or Atom feed for the index. No key needed. An admin reviews every suggestion before anything is fetched; approved podcast feeds are handed to rssamplifier, everything else becomes a source here.
`tld_changes`	read	Top-level domains added to or removed from IANA
`tmdb-artwork`	read	The poster, synopsis and TMDB id for a title that only IMDb listed, looked up by its IMDb id. Needs TMDB_API_KEY.
`upcoming`	read	Items dated in the future (releases, launches, deadlines), soonest first.
`update_profile`	write	Edit a profile you own (needs a key). Send
`wikipedia`	read	The opening paragraph and picture from the matching Wikipedia article.
`youtube`	read	The top videos for the item: trailers for games and sets, official audio for releases, webcasts for launches.

Trust audit

BLOCKgrade F · trust 41/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (9 observation(s))
Network: declared (14 observation(s))
Shell: declared (1 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHNetwork egress · net.env_exfil · CWE-200, CWE-319

ops/selfhost-supabase/server/setup-server.sh:110

/.env" ... curl

Why it matters. reads secrets in the same file that sends data out

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319

packages/db/src/index.js:27

tls: url.includes('sslmode=require') ? { rejectUnauthorized: false } : undefined,

Why it matters. certificate verification is disabled

Fix. leave verification on

HIGHHard-coded secrets · secret.db_uri · CWE-798, CWE-321

.env.example:2

DATABASE_URL=postgres://nichedb:nichedb@localhost:5432/nichedb

HIGHHard-coded secrets · secret.db_uri · CWE-798, CWE-321

docker-compose.yml:10

DATABASE_URL: postgres://nichedb:nichedb@db:5432/nichedb

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

Dockerfile:43

CMD bun -e "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

ops/selfhost-supabase/app/nginx-vhost.conf:33

proxy_pass http://127.0.0.1:__APP_PORT__;

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

ops/selfhost-supabase/nichedb-db:738

[ "$(tgt_exec "curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:$APP_PORT/healthz")" = 200 ] && { ok=1; break; }