← Back to search

io.github.cyanheads/eia-energy-mcp-server

cyanheads streamable_http Scanned 24d ago

Browse and query the EIA API v2 — electricity, petroleum, natural gas, coal, forecasts via MCP.

C
73.3 / 100

Versions

0.2.0latest
first seen Jun 5, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 7

eia_describe_route
annotations: verified low

Returns metadata for a leaf route: available facets with their valid values, data column names and units, frequency options, and date range. Call this before eia_query_route to discover valid facet IDs, facet values, column IDs, and frequency codes. Each facet returns a capped window of its values with value_count and values_truncated alongside; pass facet and values_offset to page through the rest of one facet. A values_offset past the last value of a facet returns an empty window for it and a notice naming the count to page against. Facet values are fetched from separate EIA endpoints and merged — results are cached per-route for the process lifetime to minimize API calls.

id string input object route string output object
readOnlyHint true openWorldHint false
eia_query_route
annotations: verified low

Fetches data from a leaf route with optional facet filters, date range, frequency, and column selection. Use eia_describe_route first to discover valid facet IDs, facet values, column IDs, and frequency codes. Data values are strings in the response (EIA API returns all numeric values as strings, e.g. "9.13"); cast to DOUBLE in SQL when arithmetic is needed. Returns a preview inline and stages nothing by default — one upstream request, whatever total says. Pass stage: true to also page past the preview and stage the accumulated set as a DataCanvas table, then pass the returned dataset name to eia_dataframe_query for SQL. Every dataset a tenant stages lands in the same canvas, so tables from different routes cross-join by name with nothing to thread between calls.

end string input object column string direction enum
readOnlyHint true openWorldHint false
eia_dataframe_drop
annotations: verified low

Drop a canvas dataframe by name. Idempotent — returns dropped=false when nothing matched. Use to free canvas resources ahead of the per-dataframe expiry when an analysis is complete. In normal operation, expiry cleanup (default 24 h, extended by every query that references the dataframe) is sufficient and this tool is unnecessary. Only available when EIA_DATAFRAME_DROP_ENABLED=true and a DataCanvas is configured.

input object output object
readOnlyHint false openWorldHint false idempotentHint true destructiveHint true
eia_dataframe_query
annotations: verified low

Run a single-statement SELECT against canvas dataframes registered by eia_query_route calls that passed stage: true — a query that staged nothing leaves no table to select from. Standard DuckDB SQL — joins, aggregates, window functions, CTEs all supported. Reference dataframes by the df_<id> handles returned by eia_query_route or listed by eia_dataframe_describe. Read-only: writes, DDL, DROP, COPY, PRAGMA, ATTACH, and external-file table functions are rejected. System catalogs (information_schema, pg_catalog, sqlite_master, duckdb_*) are denied. EIA data values are VARCHAR — use CAST(col AS DOUBLE) for arithmetic and aggregation. Optional register_as chains results as a new dataframe with a fresh expiry. Every dataframe named in the statement has its expiry extended by the query.

readOnlyHint true openWorldHint false idempotentHint true
eia_dataframe_describe
annotations: verified low

List canvas dataframes (df_<id>) materialized by eia_query_route calls that passed stage: true, with provenance, expiry, row count, and column schema. Nothing is staged until such a call runs, so an empty list on a fresh session means no query has staged yet, not that staging failed. Drops entries for dataframes the canvas no longer holds before responding, so the list is always current. Pass a specific name to inspect one dataframe; omit to list all active dataframes for this tenant. A name that is not staged comes back as found=false alongside the handles that are, never as an empty list. Listing is not use: only an eia_dataframe_query statement naming a dataframe extends its expiry, so a dataframe polled with this tool and never queried still lapses on schedule.

input object output object created_at string source_tool string
readOnlyHint true openWorldHint false idempotentHint true
eia_browse_routes
annotations: mismatch low

Lists child routes under a given path in the EIA dataset taxonomy. Start with no path to get the 14 top-level categories (electricity, petroleum, natural-gas, steo, aeo, ieo, seds, etc.), then drill into subcategories. Each result includes an isLeaf flag — leaf routes are queryable endpoints; non-leaf routes have children to browse. When isLeaf is true on the browsed path itself, switch to eia_describe_route.

id string path string input object output object
readOnlyHint true openWorldHint false
eia_search_routes
annotations: verified low

Fuzzy text search across route names, descriptions, and category labels. Resolves natural-language queries like "electricity retail sales by state" or "natural gas imports" to matching route paths. Multi-term queries are also matched term by term, so combining a commodity, a metric, and a sector — "electricity price residential", "coal generation industrial sector" — reaches the route carrying that data even when no single entry reads like the whole phrase. STEO series names are indexed so queries like "ethanol net imports" or "crude oil production forecast" also resolve, and so are facet values, so a fuel type or sector term like "wind" or "anthracite coal" resolves to the route that exposes it, with filter_hint carrying the filter to pass on. Results include isLeaf so you know whether to browse further or query directly. Results with score > 0.72 are weak matches — try a more specific query or use eia_browse_routes to explore the taxonomy. The first call after server start waits 24-30s while the index warms, and at most 45s; every later call returns in milliseconds. Check indexComplete before reading anything into a short or empty result set.

input object output object
readOnlyHint true openWorldHint false

Permissions 3

network medium
Server uses network capabilities via: fetch()
shell high
Server uses shell capabilities via: child_process, spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 26

info
Tool 'eia_describe_route' annotations are consistent annotation_checker · 80%
info
Tool 'eia_query_route' annotations are consistent annotation_checker · 80%
info
Tool 'eia_dataframe_drop' annotations are consistent annotation_checker · 80%
info
Tool 'eia_dataframe_query' annotations are consistent annotation_checker · 80%
info
Tool 'eia_dataframe_describe' annotations are consistent annotation_checker · 80%
medium
Tool 'eia_browse_routes' claims readOnly but schema suggests write operation annotation_checker · 70%
info
Tool 'eia_search_routes' annotations are consistent annotation_checker · 80%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
info
package.json metadata manifest_parser · 100%
info
Tool: eia_describe_route manifest_parser · 75%
info
Tool: eia_query_route manifest_parser · 75%
info
Tool: eia_dataframe_drop manifest_parser · 75%
info
Tool: eia_dataframe_query manifest_parser · 75%
info
Tool: eia_dataframe_describe manifest_parser · 75%
info
Tool: eia_browse_routes manifest_parser · 75%
info
Tool: eia_search_routes manifest_parser · 75%
info
Required env vars (5) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
critical
Tool poisoning in 'eia_describe_route': Cross-tool sequencing directive poisoning · 85%
critical
Tool poisoning in 'eia_search_routes': Cross-tool prerequisite: 'first call/use' poisoning · 85%
info
SBOM generated: 13 components sbom_generator · 100%
high
Hardcoded Password found in cyanheads-eia-energy-mcp-server-4a15c41/framework-skills/api-utils/references/security.md secret_scanner · 65%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%