← Back to search

io.github.cyanheads/socrata-mcp-server

cyanheads streamable_http Scanned 22d ago

Search and query government open-data portals via the Socrata SODA 2.1 and Discovery APIs.

B
75.4 / 100

Versions

0.1.1latest
first seen Jun 5, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 6

socrata_dataframe_query
annotations: verified low

Run SELECT-only SQL against a DataCanvas table populated by socrata_query_dataset. Columns SODA types as number (including aggregate aliases like count(*) as n) are staged as DOUBLE, so numeric comparisons work without a cast (year > 2020, amount < 500). Text and timestamp columns stay VARCHAR — compare times with CAST(date AS TIMESTAMP). Only works when CANVAS_PROVIDER_TYPE=duckdb is set. Use socrata_dataframe_describe to see registered tables and their schemas.

cap number sql string input object shown number output object canvas_id string row_count number
readOnlyHint true idempotentHint true
socrata_list_portals
annotations: verified low

List known Socrata-powered government open-data portals with their domain, organization name, and approximate dataset count. The catalog is a curated list of 39 well-known portals; dataset counts are fetched from the Discovery API and cached for ~24 hours. Filtering is client-side substring match on the query parameter. Use this first when you do not know which portal to target, then pass the domain to socrata_find_datasets.

input object offset number output object portals array totalCount number
readOnlyHint true openWorldHint false idempotentHint true
socrata_get_dataset
annotations: verified low

Fetch full metadata and column schema for a Socrata dataset by ID. Returns field names, data types, descriptions, row count, and licensing. Always call this before writing a socrata_query_dataset — the column types determine correct WHERE clause syntax: Number columns accept bare literals (year=2023) while Text columns require single-quoted strings (year='2023').

tags array input object domain string output object license string category string dataset_id string field_name string
readOnlyHint true idempotentHint true
socrata_query_dataset
annotations: verified low

Execute a SoQL query against any dataset on any Socrata portal. Use the search parameter for quick full-text lookup, or combine select/where/group/having/order for full analytical control. Returns rows plus the assembled SoQL string so you can learn the pattern. Columns are referenced by API field name (field_name from socrata_get_dataset, e.g. cuisine_description), never the display label. All SODA 2.1 row values are strings even for numeric columns — check data_type from socrata_get_dataset to determine correct WHERE quoting: Number columns use bare literals (year=2023), Text columns use single-quoted strings (year=\'2023\'). To enumerate distinct values, use select="col, count(*) as n" with group="col" and order="n DESC". When CANVAS_PROVIDER_TYPE=duckdb and rows fill limit, up to 50,000 matching rows spill to a DataCanvas table whatever the limit: list its columns with socrata_dataframe_describe, then run SQL with socrata_dataframe_query.

input object
readOnlyHint true openWorldHint false idempotentHint true
socrata_dataframe_describe
annotations: verified low

List registered tables in a DataCanvas session — schema, row count, and column names. Shows what datasets are available for SQL queries via socrata_dataframe_query. Only meaningful when CANVAS_PROVIDER_TYPE=duckdb is set. Use after socrata_query_dataset spills a large result set to canvas.

input object output object canvas_id string
readOnlyHint true idempotentHint true
socrata_find_datasets
annotations: verified low

Search for datasets across all Socrata-powered government open-data portals, or scope to one portal with the domain parameter. Returns dataset IDs, names, domains, update timestamps, and column_names — the API field names SoQL takes, not display labels. Use socrata_get_dataset to fetch the typed column schema before writing queries — column_names carry no type information.

tags array input object offset number output object results array totalCount number effectiveQuery string
readOnlyHint true openWorldHint true idempotentHint true

Permissions 3

network medium
Server uses network capabilities via: fetch()
shell high
Server uses shell capabilities via: child_process, spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 24

info
Tool 'socrata_dataframe_query' annotations are consistent annotation_checker · 80%
info
Tool 'socrata_list_portals' annotations are consistent annotation_checker · 80%
info
Tool 'socrata_get_dataset' annotations are consistent annotation_checker · 80%
info
Tool 'socrata_query_dataset' annotations are consistent annotation_checker · 80%
info
Tool 'socrata_dataframe_describe' annotations are consistent annotation_checker · 80%
info
Tool 'socrata_find_datasets' annotations are consistent annotation_checker · 80%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
info
package.json metadata manifest_parser · 100%
info
Tool: socrata_dataframe_query manifest_parser · 75%
info
Tool: socrata_list_portals manifest_parser · 75%
info
Tool: socrata_get_dataset manifest_parser · 75%
info
Tool: socrata_query_dataset manifest_parser · 75%
info
Tool: socrata_dataframe_describe manifest_parser · 75%
info
Tool: socrata_find_datasets manifest_parser · 75%
info
Required env vars (4) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
critical
Tool poisoning in 'socrata_get_dataset': Directive language: 'always' poisoning · 85%
critical
Tool poisoning in 'socrata_get_dataset': Cross-tool sequencing directive poisoning · 85%
info
SBOM generated: 12 components sbom_generator · 100%
high
Hardcoded Password found in cyanheads-socrata-mcp-server-3dfba5d/framework-skills/api-utils/references/security.md secret_scanner · 65%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%