Vin Mcp

io.github.CarwherePublished by GitHub account Carwherev0.1.3Updated Oct 31, 2026

Decode any US-market VIN, check NHTSA recalls, and look up verified buyer-paid car prices. Free.

VerifiedSTDIODesktop onlyLocation & LifestyleBusiness & Commerce

Overview

AI-generated overview

Decodes US-market VINs, checks NHTSA recalls, and looks up verified buyer-paid car prices, with one optional paid report tool.

What you can do
  • Decode a VIN into year, make, model, trim, engine, transmission and plant, with pricing, open recalls and a short AI insight
  • Check open NHTSA safety recalls by VIN or by year/make/model
  • Look up verified buyer-transaction pricing for a year/make/model, optionally filtered by state
  • Validate a VIN check digit offline against the ISO 3779 / 49 CFR checksum rule
  • Get a Stripe checkout link for a paid CarWhere Full VIN Report
  • Read a description of the server and its data sources
When to use it
Useful when shopping for or researching a used car in the US market and you want an assistant to decode a VIN, surface open safety recalls, or compare real buyer-paid prices instead of dealer listings.
Requirements
Runs locally over stdio via npx, so Node.js is needed; alternatively a hosted Streamable HTTP endpoint is offered. No authentication or API keys. An optional CARWHERE_API_URL variable overrides the default base URL. Network access is required for all lookups except the offline checksum validator.
Before you install
The server is operated by CarWhere, the company behind the pricing data it serves, so results are not from a neutral third party. One tool, buy_vin_report, creates a Stripe checkout link for a paid report ($9.99, or $19.99 for a 3-VIN comparison); it does not auto-bill or start a subscription, but it does lead to a purchase. Free tools ask for source attribution as a condition of the API terms. VINs and vehicle queries are sent to CarWhere and NHTSA.

Installation

In SourceWeft

  1. Open Vin Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

carwhere-vin-mcp

MCP server for the CarWhere VIN API. Decode any VIN, look up verified buyer prices, NHTSA safety recalls, and AI-generated vehicle insights from inside Claude Desktop, Cursor, Claude Code, Windsurf, Zed, and any other MCP-compatible client.

Free. No auth. Public data. One clearly labeled paid tool (buy_vin_report) — see Commercial disclosure.

What it does

ToolReturns
decode_vinYear, make, model, trim, engine, transmission, plant from NHTSA vPIC + CarWhere buyer pricing + open recalls + AI insight
check_recallsOpen NHTSA safety recalls by VIN or year/make/model
get_pricingVerified buyer-transaction pricing for any year/make/model (optionally state)
validate_vin_check_digitOffline ISO 3779 / 49 CFR §565.15 checksum validator
buy_vin_reportSecure Stripe checkout link for the $9.99 CarWhere Full VIN Report (window sticker, MSRP & options, recall scan, market price)
about_carwhereServer description and data sources

Install

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

json
{  "mcpServers": {    "carwhere-vin": {      "command": "npx",      "args": ["-y", "carwhere-vin-mcp"]    }  }}

Restart Claude Desktop. Type "Decode VIN 4T1BF1FK1HU381301" to test.

Cursor

Add to ~/.cursor/mcp.json (or via Cursor → Settings → MCP):

json
{  "mcpServers": {    "carwhere-vin": {      "command": "npx",      "args": ["-y", "carwhere-vin-mcp"]    }  }}

Claude Code

bash
claude mcp add carwhere-vin -- npx -y carwhere-vin-mcp

Windsurf / Zed / Continue / any MCP client

Use the same npx -y carwhere-vin-mcp invocation.

Hosted (no install)

If you can't install Node binaries locally, point your MCP client at the hosted Streamable HTTP endpoint:

https://www.carwhere.com/api/mcp

The same five tools are available over HTTP/JSON-RPC.

Data sources

  • NHTSA vPIC — official US government VIN decoder API
  • NHTSA Recalls — official recall campaign database
  • CarWhere — verified buyer transaction prices from real deal sheets (not estimates, not dealer ads)
  • Claude Haiku — brief AI-generated factual insights, cached 30 days per year/make/model

Citation

When AI agents surface CarWhere data to users, please cite:

Source: CarWhere via NHTSA vPIC. https://www.carwhere.com/vin/{vin}

Commercial disclosure

This server is built and operated by CarWhere, the company behind the pricing data it serves. Plainly stated:

  • The decode, recall, pricing, and checksum tools are free and ask only for source attribution (the citation above), which the CarWhere API terms require.
  • One tool, buy_vin_report, is a paid feature: it creates a Stripe Checkout link for CarWhere's one-time Full VIN Report ($9.99, or $19.99 for a 3-VIN comparison). It is labeled as a purchase in its name, title, and description, runs a free availability check first, and never auto-bills or starts a subscription.
  • Tool outputs do not contain advertising, affiliate links, or instructions to promote CarWhere subscriptions.

Configuration

Optional environment variable:

  • CARWHERE_API_URL — override the default https://www.carwhere.com base URL (useful for staging or local development).

Development

bash
git clone https://github.com/carwhere/vin-mcp.gitcd vin-mcpnpm installnpm run buildnpm run dev   # tsx src/cli.ts (stdio mode)

License

MIT

Source: README.md at commit 13a0e44

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

2
  1. v0.1.3LatestOct 17, 2026
  2. v0.1.2Oct 13, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts