ModelsAtlas
Explore
Atlas / MCP servers / thehealthai / 483-risk-radar

483-risk-radarSAFE

mcp/thehealthai/fda-risk-radar-mcp
MCP server by thehealthai · ai agents · fda · healthcare · Audited 2026-10-11
⚑ Report / re-scanSource ↗

Constat — FDA & NHTSA regulatory-risk MCP server for AI agents. 14 tools: recalls, adverse events, warning letters, 483s, 510(k) predicate chains, reimbursement, vehicle safety. com.healthai/radar on the official MCP registry. Hosted at constat.dev/api/mcp.

Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
—
Transport
streamable-http
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://glama.ai/mcp/connectors/com.healthai/radar)

[](https://mcpqueen.com/s/com.healthai/radar)

The MCP server behind **Constat** — FDA & NHTSA regulatory-risk intelligence for AI agents, over the Model Context Protocol. Live public regulatory data — recalls, adverse events, warning letters, 510(k) premarket evidence, postmarket drift signals, reimbursement pathways, and vehicle safety. Decision support, not regulatory advice.

  • Endpoint: https://constat.dev/api/mcp (legacy https://radar.healthai.com/api/mcp still serves)
  • Transport: Streamable HTTP (JSON-RPC 2.0)
  • Auth: none for anonymous access (10 work units/min and 50/day per

anonymous source); an optional X-API-Key header enables the separately assigned metered allowance. Tool calls have documented work-unit costs.

The evidence corpus and tool logic run hosted at the endpoint above. This repo also ships server.mjs, a zero-dependency stdio bridge to that endpoint, so stdio-only MCP clients can use the server like any local one:

node server.mjs            # stdio MCP server, bridges to constat.dev/api/mcp
// e.g. in an MCP client config
{ "mcpServers": { "constat": { "command": "node", "args": ["/path/to/server.mjs"] } } }
docker build -t constat-mcp . && docker run -i constat-mcp   # same, container
Read from source at commit 815b4409efa0OBSERVED · 2026-10-11
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add fda-risk-radar-mcp -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "fda-risk-radar-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}
03

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (1 observation(s))
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (3)

MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862
streamable-http
Why it matters. a network transport with no auth environment variable found
Fix. require a token
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
test/server.test.mjs:43
CONSTAT_MCP_URL: `http://127.0.0.1:${address.port}`,
LOWInventory / provenance · mcp.no_tools_extracted · CWE-1104
server.json
Why it matters. the tool list is enumerated at runtime by tools/list, not declared in source
Fix. the page says so rather than showing an empty table

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 815b4409efa0full audit observations/trust-audit/mcp-server/thehealthai__fda-risk-radar-mcp.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-11815b4409efa0SAFEB89first audit
05

Questions

What is the 483-risk-radar MCP server?

Constat — FDA & NHTSA regulatory-risk MCP server for AI agents. 14 tools: recalls, adverse events, warning letters, 483s, 510(k) predicate chains, reimbursement, vehicle safety. com.healthai/radar on the official MCP registry. Hosted at constat.dev/api/mcp.

Is 483-risk-radar safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does 483-risk-radar need?

No credential environment variables were found in its source, so it appears to need none.

How does 483-risk-radar run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as fda-risk-radar-mcp at 0.5.3.

How current is this page?

The grade is for one exact copy of the source (815b4409efa0), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement