\n\n[](https://github.com/cyanheads/cpsc-recalls-mcp-server/releases/latest/download/cpsc-recalls-mcp-server.mcpb) [](https://cursor.com/en/install-mcp?name=cpsc-recalls-mcp-server&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBjeWFuaGVhZHMvY3BzYy1yZWNhbGxzLW1jcC1zZXJ2ZXIiXX0=) [](https://vscode.dev/redirect?url=vscode:mcp/install?%7B%22name%22%3A%22cpsc-recalls-mcp-server%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22%40cyanheads%2Fcpsc-recalls-mcp-server%22%5D%7D)\n\n[](https://www.npmjs.com/package/@cyanheads/mcp-ts-core)\n\n
\n\n---\n\n## Tools\n\n3 tools for searching and retrieving CPSC consumer product recall data:\n\n| Tool | Description |\n|:---|:---|\n| `cpsc_search_recalls` | Search consumer product recalls by title, product name, brand, retailer, importer, distributor, hazard, remedy, or description keyword, with optional date filtering and offset paging |\n| `cpsc_get_recall` | Full detail for a single recall by recall number — hazards, remedy, products, injuries, images, and the official CPSC page |\n| `cpsc_get_recent` | Fetch the most recent recalls ordered newest-first, scoped to a configurable date window |\n\n**CPSC jurisdiction:** Consumer products only — toys, electronics, furniture, appliances, children's products, tools, and clothing. Food and drugs (FDA), motor vehicles and tires (NHTSA), boats (USCG), and pesticides (EPA) are not in this database. Every response includes a jurisdiction note.\n\nData sourced from the [U.S. Consumer Product Safety Commission](https://www.saferproducts.gov/) via the CPSC public recalls API.\n\n### `cpsc_search_recalls`\n\nSearch recalls with flexible filtering across title, product, organization, hazard, remedy, and description fields.\n\n- Filter by `title_search`, `product_name`, `manufacturer`, `retailer`, `importer`, `distributor`, `remedy`, or `description_search` — all optional substring matches, applied upstream, combining with AND\n- `title_search` is usually the highest-signal filter: CPSC titles name the brand, the product, and the hazard\n- `hazard_search` is a client-side filter applied after the upstream fetch — it matches when the term appears in hazard descriptions, product names, **or** remedy instructions (case-insensitive). Use it for hazard concepts like \"fire\", \"choking\", or \"burn\"; the upstream `Hazard` parameter is recognized but never matches, so it is not exposed\n- `remedy` searches the free-text remedy instructions, not the `remedy_options` type enum — `remedy: \"repair\"` matches records whose `remedy_options` list only `Refund` but whose instructions describe a free repair kit\n- Two independent date axes: `date_start` / `date_end` bound the recall issue date, `updated_start` / `updated_end` bound the date CPSC last published the record. A 2003 recall re-published in 2025 matches `updated_start: \"2025-01-01\"`. All four must be real calendar dates — `2026-02-31` and `2026-99-99` are rejected at input validation, and a reversed range fails with `invalid_date_range` rather than silently returning nothing\n- Client-side limit (1–200, default 20) and `offset` (default 0) applied after fetching all matching records. Page with `offset: 0, 20, 40`; an offset at or past `total_found` returns an empty result set rather than an error\n- `total_found` counts matches after `hazard_search` is applied and before `offset`/`limit` narrow the window; `has_more` is the paging signal; `truncated` stays limit-only and does not move with `offset`\n- Returns hazard descriptions, remedy options, remedy instructions, product list, UPCs, manufacturer/importer/retailer names, images, and the CPSC recall page URL\n- Manufacturer and importer are reported and rendered as separate roles — CPSC org names contain commas, so multiple orgs in one role are separated with `; `\n- Per-recall `data_quality_notes` records gaps in the upstream record (no hazard text, no product entries); empty when nothing is missing\n- When `manufacturer` returns no results, try `importer`, `retailer`, or `distributor` — many recalls list one of those as the primary organization\n- Deterministic upstream rejections surface as `upstream_rejected` (`retryable: false`) and carry the CPSC message; transient outages stay on `upstream_error` (`retryable: true`)\n\n---\n\n### `cpsc_get_recall`\n\nFull detail for a single CPSC recall by recall number.\n\n- Accepts modern 5-digit recall numbers (e.g. `\"25043\"`) and historical 1998–2001 records with letter suffixes (e.g. `\"99003a\"`)\n- Returns the complete record: full description, all hazard descriptions, remedy type and instructions, all product variants with unit counts, UPCs, incident/injury narrative, manufacturer and importer names, retailer names with sale date ranges, country of manufacture, images, and coordinated agency recall URLs\n- Model numbers are typically embedded in the description text, not in a structured field\n- `description` is nullable — a small number of genuine CPSC records carry no description; the record is still returned and the absence is stated rather than rendered as a blank section\n- Manufacturer and importer are rendered under separate headings, so role attribution survives into `content[]`\n- `data_quality_notes` records gaps in the upstream record (absent description, no hazard text, no product entries); empty when nothing is missing\n- Use `cpsc_search_recalls` or `cpsc_get_recent` to find a recall number first\n\n---\n\n### `cpsc_get_recent`\n\nFetch the most recent CPSC recalls, ordered newest-first.\n\n- Configurable look-back window of 1–365 days (default 30)\n- Limit of 1–100 results (default 20), with `offset` (default 0) to page through `total_found`. Narrowing `days` cannot page — the window is anchored to today, so shrinking it drops the oldest records rather than advancing past the newest\n- `has_more` is the paging signal; `truncated` stays limit-only and does not move with `offset`\n- Always applies a date window — without one, the upstream API returns 9,800+ records\n- Returns a lightweight record per recall: number, date, title, hazards, remedy types, product names, and CPSC URL\n- Per-recall `data_quality_notes` records gaps in the upstream record (no hazard text, no product entries); empty when nothing is missing\n- Use `cpsc_get_recall` to retrieve full detail for any result\n\n## Features\n\nBuilt on [`@cyanheads/mcp-ts-core`](https://github.com/cyanheads/mcp-ts-core):\n\n- Declarative tool definitions — single file per tool, framework handles registration and validation\n- Unified error handling — handlers throw, framework catches, classifies, and formats\n- Pluggable auth: `none`, `jwt`, `oauth`\n- Swappable storage backends: `in-memory`, `filesystem`, `Supabase`, `Cloudflare KV/R2/D1`\n- Structured logging with optional OpenTelemetry tracing\n- STDIO and Streamable HTTP transports\n\nCPSC-specific:\n\n- Full integration with the CPSC saferproducts.gov public recalls API\n- Client-side filtering applied over complete API result sets for accurate `total_found` counts\n- Jurisdiction boundary documented in every response — prevents misattribution of food, vehicle, or drug recalls\n\nAgent-friendly output:\n\n- Jurisdiction note on every response — agents can route callers to the correct agency (FDA, NHTSA, USCG, EPA) when the product is out of scope\n- `total_found`, `offset`, `has_more`, and `truncated` fields on search/recent responses — agents can tell when results are clipped and page through the rest with `offset`\n- `cpsc_url` on every recall — authoritative source link for consumer verification\n- `source_note` on every response, plus `(CPSC source text)` labels and blockquotes in the rendered output — relayed CPSC narrative is marked as source data, distinct from the server's own guidance\n- `data_quality_notes` on every response — gaps observed in the upstream record, derived from which fields CPSC left empty rather than any judgement about the recall\n\n## Getting started\n\n### Public Hosted Instance\n\nA public instance is available at `https://cpsc-recalls.caseyjhand.com/mcp` — no installation required. Point any MCP client at it via Streamable HTTP:\n\n```json\n{\n \"mcpServers\": {\n \"cpsc-recalls-mcp-server\": {\n \"type\": \"streamable-http\",\n \"url\": \"https://cpsc-recalls.caseyjhand.com/mcp\"\n }\n }\n}\n```\n\n### Self-Hosted / Local\n\nAdd the following to your MCP client configuration file.\n\n```json\n{\n \"mcpServers\": {\n \"cpsc-recalls-mcp-server\": {\n \"type\": \"stdio\",\n \"command\": \"bunx\",\n \"args\": [\"@cyanheads/cpsc-recalls-mcp-server@latest\"],\n \"env\": {\n \"MCP_TRANSPORT_TYPE\": \"stdio\",\n \"MCP_LOG_LEVEL\": \"info\"\n }\n }\n }\n}\n```\n\nOr with npx (no Bun required):\n\n```json\n{\n \"mcpServers\": {\n \"cpsc-recalls-mcp-server\": {\n \"type\": \"stdio\",\n \"command\": \"npx\",\n \"args\": [\"-y\", \"@cyanheads/cpsc-recalls-mcp-server@latest\"],\n \"env\": {\n \"MCP_TRANSPORT_TYPE\": \"stdio\",\n \"MCP_LOG_LEVEL\": \"info\"\n }\n }\n }\n}\n```\n\nOr with Docker:\n\n```json\n{\n \"mcpServers\": {\n \"cpsc-recalls-mcp-server\": {\n \"type\": \"stdio\",\n \"command\": \"docker\",\n \"args\": [\"run\", \"-i\", \"--rm\", \"-e\", \"MCP_TRANSPORT_TYPE=stdio\", \"ghcr.io/cyanheads/cpsc-recalls-mcp-server:latest\"]\n }\n }\n}\n```\n\nFor Streamable HTTP, set the transport and start the server:\n\n```sh\nMCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http\n# Server listens at http://localhost:3010/mcp\n```\n\n### Prerequisites\n\n- [Bun v1.3.0](https://bun.sh/) or higher (or Node.js v24+).\n- No API key required — the CPSC public recalls API is freely accessible.\n\n### Installation\n\n1. **Clone the repository:**\n\n```sh\ngit clone https://github.com/cyanheads/cpsc-recalls-mcp-server.git\n```\n\n2. **Navigate into the directory:**\n\n```sh\ncd cpsc-recalls-mcp-server\n```\n\n3. **Install dependencies:**\n\n```sh\nbun install\n```\n\n4. **Configure environment:**\n\n```sh\ncp .env.example .env\n# edit .env if needed — no required API keys\n```\n\n## Configuration\n\nAll configuration is validated at startup via Zod schemas. Key environment variables:\n\n| Variable | Description | Default |\n|:---|:---|:---|\n| `MCP_TRANSPORT_TYPE` | Transport: `stdio` or `http` | `stdio` |\n| `MCP_HTTP_PORT` | HTTP server port | `3010` |\n| `MCP_HTTP_HOST` | HTTP server host | `127.0.0.1` |\n| `MCP_HTTP_ENDPOINT_PATH` | HTTP endpoint path | `/mcp` |\n| `MCP_PUBLIC_URL` | Public origin for TLS-terminating reverse-proxy deployments | — |\n| `MCP_SESSION_MODE` | Session handling: `auto`, `stateful`, or `stateless`. The schema default `auto` resolves to stateful; this server sets `stateless` explicitly. | `stateless` |\n| `MCP_AUTH_MODE` | Authentication: `none`, `jwt`, or `oauth` | `none` |\n| `MCP_LOG_LEVEL` | Log level (`debug`, `info`, `warning`, `error`) | `info` |\n| `LOGS_DIR` | Directory for log files (Node.js only) | `/logs` |\n| `STORAGE_PROVIDER_TYPE` | Storage backend: `in-memory`, `filesystem`, `supabase`, `cloudflare-kv/r2/d1` | `in-memory` |\n| `OTEL_ENABLED` | Enable OpenTelemetry | `false` |\n\nNo server-specific API keys are required. See [`.env.example`](./.env.example) for the full list of optional overrides.\n\n## Running the server\n\n### Local development\n\n- **Build and run the production version:**\n\n ```sh\n # One-time build\n bun run rebuild\n\n # Run the built server\n bun run start:stdio\n # or\n bun run start:http\n ```\n\n- **Run checks and tests:**\n\n ```sh\n bun run devcheck # Lint, format, typecheck, security\n bun run test # Vitest test suite\n ```\n\n### Docker\n\n```sh\ndocker build -t cpsc-recalls-mcp-server .\ndocker run --rm -p 3010:3010 cpsc-recalls-mcp-server\n```\n\nThe Dockerfile defaults to HTTP transport, stateless session mode, and logs to `/var/log/cpsc-recalls-mcp-server`. OpenTelemetry peer dependencies are installed by default — build with `--build-arg OTEL_ENABLED=false` to omit them.\n\n## Project structure\n\n| Directory | Purpose |\n|:---|:---|\n| `src/index.ts` | `createApp()` entry point — registers tools and inits the CPSC service |\n| `src/mcp-server/tools` | Tool definitions (`*.tool.ts`). Three tools: search, get-recall, get-recent |\n| `src/services/cpsc-recall` | CPSC recall service — API client, types, normalization |\n\n## Development guide\n\nSee [`CLAUDE.md`](./CLAUDE.md) / [`AGENTS.md`](./AGENTS.md) for development guidelines and architectural rules. The short version:\n\n- Handlers throw, framework catches — no `try/catch` in tool logic\n- Use `ctx.log` for request-scoped logging, `ctx.state` for tenant-scoped storage\n- Register new tools in the `createApp()` arrays in `src/index.ts`\n- Wrap external API calls: validate raw → normalize to domain type → return output schema; never fabricate missing fields\n\n## Contributing\n\nIssues and pull requests are welcome. Run checks and tests before submitting:\n\n```sh\nbun run devcheck\nbun run test\n```\n\n## License\n\nApache-2.0 — see [LICENSE](LICENSE) for details.\n",
"bytes": 14634,
"sha": "7dcf12acd25a5cd5f0193df9eedaa2c56c6853f1960af4f8534ea19558762eaa",
"repo_slug": "cyanheads/cpsc-recalls-mcp-server",
"fonte": "repo",
"truncated": false,
"api": "https://agentalog.com/api/listings/mcp_io_github_cyanheads_cpsc_recalls_mcp_ser_eb690dea/readme"
}