Loading…
Weather forecasts, alerts, outlooks, observations, AQI, and map imagery.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 27 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The sw-mcp MCP server exposes 31 tools, focused primarily on database and developer capabilities. Its published description reads: "Weather forecasts, alerts, outlooks, observations, AQI, and map imagery". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates sw-mcp F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Cross-tool shadowing" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check sw-mcp's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add sw-mcp to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://mcp.smarterweather.com/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Complete weather overview for a location: current conditions, daily forecast (day/night periods, SPC threats, severity, CAPE, UV), active alerts, and convective outlooks in one call. Data is pre-aggre
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: get_forecast
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: get_hourly_forecast
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: reverse_geocode
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: get_alerts
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: get_time_context
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: get_period_totals
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: compare_locations
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: find_best_window
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: get_outlooks
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: get_forecast_discussion
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: get_storm_reports
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: get_lightning_activity
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: get_sounding
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: get_forecast_distribution
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: get_current_conditions
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: get_observations
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: list_datasets
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: describe_dataset
A tool description tries to alter the model’s use of another tool.
ata. Use before query_dataset to discover valid variable names. Example: {"daRecommendationDescriptions must describe only their own tool.
tool: query_dataset
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: get_growing_degree_days
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
total (observed history + today + forecast) plus a per-day cumulative sRecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_growing_degree_days
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: get_climate_normals
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: get_forecast_skill
A tool description tries to alter the model’s use of another tool.
gnitude -- did it rain, at the thresholdMm stated on the entry -- with podRecommendationDescriptions must describe only their own tool.
tool: get_storm_cells
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: get_air_quality
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: get_map_snapshot
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: get_sounding_chart
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: get_forecast
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_hourly_forecast
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: search_locations
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: reverse_geocode
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_alerts
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_time_context
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_period_totals
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: compare_locations
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: find_best_window
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_outlooks
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_forecast_discussion
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_storm_reports
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_lightning_activity
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_sounding
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_forecast_distribution
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_current_conditions
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_observations
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_datasets
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: describe_dataset
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: query_dataset
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_growing_degree_days
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_climate_normals
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_forecast_skill
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_tropical
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_population_exposure
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_climate_records
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_storm_cells
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_air_quality
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_platform_status
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_forecast_skill
An unusually long description is a common injection-padding tactic.
description length 3449 charsRecommendationKeep descriptions concise.
tool: get_map_snapshot
An unusually long description is a common injection-padding tactic.
description length 2310 charsRecommendationKeep descriptions concise.
The server exposes one or more ui:// (MCP Apps) resources whose HTML/JS renders inside the host client — a client-side injection / data-exposure surface most scanners ignore. Flagged for review, not damning on its own.
1 ui:// resource(s); e.g. ui://weather-widget/v1/index.htmlRecommendationReview each ui:// resource’s markup and scripts; treat host-rendered UI as untrusted, sandbox it, and never expose secrets or conversation context to it.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Blended hourly forecast: temperature, feels-like, humidity, wind, precipitation probability/amount, conditions, and icon per hour. Snapped to the current hour so hourly[0] is "now". Timestamps are UTC
Resolve a place query to candidate locations with coordinates. Accepts city names ("Denver"), city+state ("Portland, OR" via query), ZIP codes ("50219"), or partial input with fuzzy=true for autosugge
Resolve coordinates to a human-readable place (city, state, county, timezone). Use when you have lat/lon but need a display name or the local timezone. Example: {"lat": 39.74, "lon": -104.99} -> Denve
NWS watches, warnings, advisories. Point (city/ZIP/lat+lon): containing polygons. BBox or US state/DC/CONUS (codes, full names, US/national): intersecting polygons. A city miss is not a statewide all-
Complete temporal context for a location: local time, timezone, 14-day calendar with day names and Today/Tomorrow offsets, sunrise/sunset/solar times (from the weather pipeline's astro product), and m
Aggregate a weather variable over one or more time periods. Returns server-computed totals, maxima, minima, or averages per period. Period start/end times should use the user's local timezone boundari
Compare forecast variables across multiple locations side-by-side in one batched call. Returns a distilled per-location series matrix for direct comparison -- prefer this over N sequential forecast ca
Find the optimal time window for an activity based on weather criteria. Scans the forecast and returns daylight-aware periods matching all conditions. Criteria are expressed in the selected `units` sy
Hazard outlooks affecting a location. hazard=severe returns SPC convective outlooks (Day 1-8 categorical risk + tornado/wind/hail probabilities); hazard=fire returns SPC fire weather outlooks; hazard=
Expert forecaster text products. type=afd: Area Forecast Discussion. type=hwo: Hazardous Weather Outlook. type=now: WFO short-term NOW. type=fwf/hls/esf: local fire weather / hurricane local statement
Recent NWS Local Storm Reports (LSRs) -- verified reports of tornadoes, hail, damaging winds, flooding near a location. Use to confirm severe weather occurrence or assess reported damage. valid_time i
Real-time lightning near a location: GLM satellite flash count (30km/10min) and MRMS ground-truth lightning density + 30-minute probability. The summary field is ready-to-use. A zero flash count means
Nearest RAOB (radiosonde) vertical soundings to a point. Each sounding carries: profile (pressure-indexed thermodynamics: pressure_hpa, height_m, temperature_c, dewpoint_c, wind arrays), wind_profile
Probabilistic forecast guidance from NBM for one aspect of the weather: percentile ranges (p10-p90), exceedance probabilities, and ensemble spread. Use this for any question about odds, ranges, potent
Current weather right now at a location from two independent sources in one call: the RTMA gridded analysis (exact-point values, updated sub-hourly) and the nearest METAR station observation (ground t
METAR surface observations from weather stations: temperature, wind, visibility, ceiling, flight category, raw METAR. Nearest mode (default) returns the closest N stations to a location; station mode
Discover the datasets (model grids, analyses, observations) available at a location, with per-dataset freshness (data age, latest model run). Datasets vary by domain (CONUS/Alaska/Hawaii). Use this to
Variables available in a dataset, with standard names, units, descriptions, and the time range of available data. Use before query_dataset to discover valid variable names. Example: {"dataset_id": "nb
Raw time series from a specific dataset for specific variables at a point. Power-user access to any gridded product (NBM, HRRR, GFS, RTMA, MRMS, air quality, ...). Time modes: hours (next N hours, def
Growing Degree Units (GDU / GDD) for a US location (CONUS, Alaska, Hawaii), computed from daily max/min temperatures. Pass a crop id (e.g. "corn", "soybean", "wheat") to use calibrated base/upper thre
Day-of-year climate normals (NCEI 1991-2020 30-year averages) for a US location, from the nearest station with a record. Returns normal high, normal low, and normal mean for each date in the window, p
How accurate our forecasts have actually been near a location, measured against observed analysis truth. Returns bias (positive = the model runs high), mean absolute error, RMSE, and a skill score aga
Active NHC (National Hurricane Center) tropical systems: forecast cones, track lines, forecast points, coastal watches/warnings, and 7-day Tropical Weather Outlook formation areas -- Atlantic + East P
National population-exposure headline for a risk-zone outlook product: how many people are inside risk bands at or above min_level. Powers headlines like "~57M people under major heat risk tomorrow".
NWS daily climate data: type=reports returns CLI daily climate reports (observed high/low/precip vs normals per station); type=records returns RER record event reports (record highs/lows/rainfall actu
Radar-identified storm cells near a location, merging NEXRAD Level III algorithm output from the nearest radar site: storm tracks (cell position, movement, forecast positions), hail index (probability
AirNow air quality at a location (CONUS): current overall AQI plus per-pollutant detail (PM2.5, ozone, PM10 concentrations) and the AirNow AQI forecast. AQI scale: 0-50 good, 51-100 moderate, 101-150
Render a weather map image for visual analysis. Simple form: pass `product` (a viz-catalog product_id like "mrms_qpe_01h_pass2_conus", "goes_truecolor_conus", "spc_day1_categorical", "hrrr_precip_hybr
Render the nearest RAOB (radiosonde) sounding as a Skew-T log-P + hodograph chart image for visual analysis: temperature/dewpoint traces, wind barbs, height-banded hodograph, and a derived-indices tab
Current data-freshness status of the weather platform: overall state, per-source states (ok / degraded / outage / no_signal), open incidents with cause attribution (provider outage vs internal process