io.github.cyanheadsPublished by GitHub account cyanheadsv0.11.0Updated Nov 4, 2026
Decode VINs, search recalls, complaints, crash ratings, and investigations.
Serves U.S. NHTSA vehicle safety data so an assistant can decode VINs and look up recalls, complaints, crash ratings and defect investigations.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/io.github.cyanheads%2Fnhtsa-vehicle-safety-mcp-server/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Add this to your client's mcpServers config.
{
"mcpServers": {
"nhtsa-vehicle-safety": {
"type": "http",
"url": "https://nhtsa.caseyjhand.com/mcp"
}
}
}Decode VINs, search recalls, complaints, crash ratings, and investigations via MCP. STDIO or Streamable HTTP.
Public Hosted Server: https://nhtsa.caseyjhand.com/mcp
Vehicle safety data from NHTSA: recalls, consumer complaints, NCAP crash ratings, defect investigations, and VIN decoding. Get a full safety picture for any make, model, and year in one call, or decode a VIN.
nhtsa_get_vehicle_safety toolsummary, consequence, and remedy are omitted for older campaigns whose record leaves them blanksectionStatus (available/partial/unavailable per section) plus warnings so a partial NHTSA outage is not mistaken for a clean recordnotice points at nhtsa_lookup_vehicles with operation="dataset_models", because NHTSA can file one vehicle under different model names in each datasetnhtsa_search_recalls toolcampaignNumber; make + model + modelYear together; or a broad search with any other combination of make, model, modelYear, and dateRange. campaignNumber is mutually exclusive with the vehicle fields00V419) returns every campaign it coverstotalCount, up to 50 per page (default 20) with limit and offset, and a larger limit is lowered to 50 with a notice; both are rejected with the other two modes. A campaign matches when one of its vehicle records carries every vehicle filter, compared against whole make and model names, ignoring casedateRange bounds (after/before, calendar-valid YYYY-MM-DD) apply in every mode; blank bounds are unsetnhtsa_search_complaints toollimit is lowered to 50 with a notice naming the next offset (see NHTSA_CLAMP_LIMITS)component filter matches case-insensitively within each component name a complaint lists (e.g., "ENGINE", "AIR BAGS"); component names can themselves contain ", " (e.g., "SERVICE BRAKES, HYDRAULIC")unreliableIncidentDate rather than served as the incident datenhtsa_get_safety_ratings toolvehicleId from an earlier result; combining the modes is rejectednhtsa_decode_vin tool* for unknown positions, each as its own entrydeferredVins to pass back as vin. VIN,YYYY gives one VIN its own model year; optional modelYear covers the others*, or a VIN over 17 characters is rejected before decoding (empty_vin_list, invalid_vin)Optional means the configuration offers the feature, not that this vehicle has iterrorCode/errorText decode-quality signal, including the clean "0" casenhtsa_search_investigations toolmake, model, modelYear, and component filters — all ANDed. make, model, and modelYear must all match the same vehicle association; an investigation with no model year never matches a modelYearmanufacturers and recallCampaigns entrysummary; set includeSummary: true to include it, or fetch one record with nhtsaId, which always returns itopenDateRange and closeDateRange bounds (after/before, calendar-valid YYYY-MM-DD) filter before counting and pagination; active bounds exclude records without the corresponding usable datenhtsaId fetches one investigation by its exact ID, mutually exclusive with the other filters — the reverse of the recall link, closing the campaign-to-investigation round tripFLAT_INV.zip), loaded on first use and cached for 24 hourslimit is lowered to 50 with a noticenhtsa_lookup_vehicles toolmakes, models, vehicle_types, manufacturer, dataset_models — models, vehicle_types, and manufacturer match partial namesdataset_models (requires make and modelYear) lists the model names NHTSA's complaint, NCAP, and VPIC lists carry, each tagged listedBy products, ncap, or vpic. It takes the full make name (e.g., "Chevrolet"). Use it when a recall, complaint, or rating search comes back empty, then search under each namemodels can be filtered by year; models and vehicle_types both require makemakes accepts none, models and dataset_models accept make/modelYear, vehicle_types accepts make, and manufacturer accepts manufacturer. Optional blank strings are unset; operation-required make/manufacturer names must be nonblanklimit is lowered to 200 with a noticemanufacturer lookups stop at a 500-record ceiling and disclose truncated when more may exist — VPIC publishes no match totalBuilt on @cyanheads/mcp-ts-core: stdio and Streamable HTTP transports, pluggable auth (none / jwt / oauth), swappable storage (in-memory, filesystem, Supabase, Cloudflare KV/R2/D1), structured logging with optional OpenTelemetry tracing.
NHTSA-specific:
nhtsa-vehicle-safety-guide skill (skill://nhtsa-vehicle-safety-guide/SKILL.md) with the identifier chains and gates for merging results across model names, make versus manufacturer, model year versus received date, and what an empty or Not Rated result provesAgent-friendly output:
effectiveQuery in its enrichment block, so callers can verify exactly what was searchednhtsa_get_vehicle_safety returns sectionStatus per section plus warnings, so a partial NHTSA outage isn't mistaken for a clean safety recordunreliableIncidentDate (complaints), VIN decode errorCode/errorText, and manufacturer-lookup truncated disclose data-quality limits rather than silently omitting or fabricating valuesA public instance is available at https://nhtsa.caseyjhand.com/mcp — no installation required. Point any MCP client at it via Streamable HTTP:
Add the following to your MCP client configuration file:
Or with npx (no Bun required):
Or with Docker:
For Streamable HTTP, set the transport and start the server:
No API keys required — all NHTSA APIs are public.
See .env.example for the full list of optional overrides.
Build and run:
Run checks and tests:
The Dockerfile defaults to HTTP transport and logs to /var/log/nhtsa-vehicle-safety-mcp-server; it restates the stateless session mode the server already declares. OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them.
See CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for request-scoped loggingnhtsa_ prefix for every tool name, registered in createApp()All data comes from NHTSA's public APIs and bulk files:
api.nhtsa.gov/recallsapi.nhtsa.gov/complaints; dataset_models also reads its model-name list at api.nhtsa.gov/products/vehicle/modelsapi.nhtsa.gov/SafetyRatingsstatic.nhtsa.gov/odi/ffdd/inv/FLAT_INV.zipstatic.nhtsa.gov/odi/ffdd/rcl/FLAT_RCL_POST_2010.zip and FLAT_RCL_PRE_2010.zip, used by broad nhtsa_search_recalls searchesvpic.nhtsa.dot.gov/api/vehiclesIssues are welcome. Run checks and tests before submitting:
Apache-2.0 — see LICENSE for details.
Source: README.md at commit 03b7683
Nhtsa Get Vehicle Safety
Get a comprehensive safety profile for a vehicle. Combines NCAP crash test ratings, recalls, and complaint summary into a single response. Use as the default when asked about vehicle safety, reliability, or purchase decisions.
makerequiredmodelrequiredmodelYearrequiredNhtsa Search Recalls
Search recall campaigns by campaign number, by vehicle, or across every campaign by make, model, model year, and received date. campaignNumber returns that campaign with every vehicle it covers; make, model, and modelYear together return that vehicle's recalls; any other combination of make, model, modelYear, and dateRange is a broad search of NHTSA's recall files, newest first, paged with limit and offset. A broad search matches a campaign when one of its vehicle records carries every vehicle filter given, and the received date it reports can fall one day before the date the other modes report for the same campaign.
makelimitmodeloffsetdateRangemodelYearcampaignNumberNhtsa Search Complaints
Search consumer safety complaints filed with NHTSA for a specific vehicle. Returns a component breakdown over all matching complaints plus a paginated slice of the most recent complaints. Use for common problems, failure patterns, or owner-reported issues.
makerequiredlimitmodelrequiredoffsetcomponentmodelYearrequiredNhtsa Get Safety Ratings
Get NCAP crash test ratings and ADAS feature availability for a vehicle. Use when the user specifically wants crash test stars, rollover risk, or wants to compare safety features across vehicles. NCAP data available from 1990+, best coverage for 2011+.
makemodelmodelYearvehicleIdNhtsa Decode Vin
Decode Vehicle Identification Numbers to extract make, model, year, body type, engine, manufacturing details, and safety equipment: airbags, stability and braking systems, tire pressure monitoring, and the driver-assistance features VPIC records for the configuration, such as automatic emergency braking, lane keeping, blind spot warning, backup camera, and adaptive cruise control. Pass one VIN, or several as an array or in one string separated by spaces, semicolons, or commas. Partial VINs are accepted, with * for unknown positions; send each partial VIN as its own string or array entry. A call decodes up to 50 VINs; VINs past the first 50 come back in deferredVins to pass back as vin.
vinrequiredmodelYearNhtsa Search Investigations
Search NHTSA defect investigations — Preliminary Evaluations (PE), Engineering Analyses (EA), Defect Petitions (DP), Recall Queries (RQ), Audit Queries (AQ), and additional ODI types — newest-opened first. make, model, and modelYear match the investigation's vehicle associations, all on the same association; component matches its affected components. All filters are ANDed. Search rows leave out the full summary unless includeSummary is true. Use nhtsaId to fetch one investigation by its exact ID with its full summary — including the investigationId nhtsa_search_recalls returns for a campaign. recallCampaigns lists the recall campaigns NHTSA links to an investigation; pass any to nhtsa_search_recalls as campaignNumber.
makelimitmodelqueryoffsetstatusnhtsaIdcomponentmodelYearopenDateRangecloseDateRangeincludeSummary+1 moreNhtsa Lookup Vehicles
Look up makes, models, vehicle types, and manufacturer details in NHTSA's VPIC catalog, or list the model names NHTSA's datasets file a make and model year under. VPIC names often differ from the names complaints and NCAP ratings use (Silverado vs SILVERADO 1500), and a vehicle's recalls can be split between a series name and a base name. When a recall, complaint, or rating search comes back empty or partial, call operation="dataset_models" with make and modelYear, then search under each name it lists. No list enumerates recall names, so search recalls under both the series name and the base name.
makelimitoffsetmodelYearoperationrequiredmanufacturer100% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
{ "mcpServers": { "nhtsa-vehicle-safety-mcp-server": { "type": "streamable-http", "url": "https://nhtsa.caseyjhand.com/mcp" } }}{ "mcpServers": { "nhtsa-vehicle-safety-mcp-server": { "type": "stdio", "command": "bunx", "args": ["@cyanheads/nhtsa-vehicle-safety-mcp-server@latest"], "env": { "MCP_TRANSPORT_TYPE": "stdio", "MCP_LOG_LEVEL": "info" } } }}{ "mcpServers": { "nhtsa-vehicle-safety-mcp-server": { "type": "stdio", "command": "npx", "args": ["-y", "@cyanheads/nhtsa-vehicle-safety-mcp-server@latest"], "env": { "MCP_TRANSPORT_TYPE": "stdio", "MCP_LOG_LEVEL": "info" } } }}{ "mcpServers": { "nhtsa-vehicle-safety-mcp-server": { "type": "stdio", "command": "docker", "args": ["run", "-i", "--rm", "-e", "MCP_TRANSPORT_TYPE=stdio", "ghcr.io/cyanheads/nhtsa-vehicle-safety-mcp-server:latest"] } }}MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http# Server listens at http://localhost:3010/mcpgit clone https://github.com/cyanheads/nhtsa-vehicle-safety-mcp-server.gitcd nhtsa-vehicle-safety-mcp-serverbun installcp .env.example .env# edit .env to override transport, auth, or storage defaults — no API key required# One-time buildbun run rebuild
# Run the built serverbun run start:stdio# orbun run start:httpbun run devcheck # Lint, format, typecheck, securitybun run test # Vitest test suitebun run lint:mcp # Validate MCP definitions against specdocker build -t nhtsa-vehicle-safety-mcp-server .docker run --rm -p 3010:3010 nhtsa-vehicle-safety-mcp-serverbun run devcheckbun run test