MCP server

PH Civic Data

mcp:xmpuspus/ph-civic-data-mcp

PH civic data as MCP tools: the full PSA OpenSTAT catalog, hazards, procurement. 41 tools.

awesome-mcp-servers Glama MCP Registry

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 26, 2026, 12:53 UTC at 922cf94

findings

medium

highest severity

threat classes

154

files scanned

1,230/1,230

checks satisfied

package advisories

Why this verdict

suspicious: finding mcp-server:.:src/ph_civic_data_mcp/sources/phivolcs.py:1:MANIP
suspicious: finding mcp-server:.:src/ph_civic_data_mcp/utils/http.py:93:MANIP

Security findings 2

Manipulation

mediumContextual risklow confidence

The PHIVOLCS HTTP client disables TLS certificate verification (verify=False), so earthquake and volcano data fetched from PHIVOLCS hosts could be tampered with by a network attacker. Mitigated by a strict https *.phivolcs.dost.gov.ph allowlist with per-hop redirect checks.

src/ph_civic_data_mcp/sources/phivolcs.py:1-685

use PHIVOLCS_CLIENT with verify=False

vector:code

Counter-argument considered

verify=False is real and runs on the tool path. The host allowlist and per-hop redirect checks stop the client escaping to other hosts, but they do not stop a network attacker tampering with responses from PHIVOLCS hosts, and bulletin text is returned to the agent. It is documented and low severity, but documentation does not refute it.

Manipulation

mediumContextual risklow confidence

A dedicated PHIVOLCS httpx client disables TLS certificate verification, so responses from that host could be tampered with by a network attacker; it is scoped to one client with redirects disabled and documented as a broken upstream cert chain.

src/ph_civic_data_mcp/utils/http.py:93

verify=False,

vector:code

Counter-argument considered

The client is scoped to PHIVOLCS with redirects off, but disabling certificate verification still allows on-path tampering of the data it returns to the agent. This is a low-severity tradeoff and not a carve-out.

Execution chain 500

What it calls, runs, installs, reads and writes, with the line that does it.

Environment variables 1

PAGASA_API_TOKEN

src/ph_civic_data_mcp/sources/pagasa.py:308 · read

GitHub repositories 8

xmpuspus/ph-civic-data-mcp

manifest.json:13 · url

xmpuspus/ph-civic-data-mcp

manifest.json:16 · url

xmpuspus/ph-civic-data-mcp

pyproject.toml:40 · url

xmpuspus/ph-civic-data-mcp

pyproject.toml:41 · url

xmpuspus/ph-civic-data-mcp

pyproject.toml:42 · url

xmpuspus/ph-civic-data-mcp

server.json:7 · url

xmpuspus/ph-civic-data-mcp

src/ph_civic_data_mcp/_mcp.py:17 · url

xmpuspus/ph-civic-data-mcp

src/ph_civic_data_mcp/utils/http.py:36 · url

Network calls 6

src/ph_civic_data_mcp/utils/http.py:27 · call

src/ph_civic_data_mcp/utils/http.py:79 · call

src/ph_civic_data_mcp/utils/http.py:80 · call

src/ph_civic_data_mcp/utils/http.py:92 · call

src/ph_civic_data_mcp/utils/http.py:94 · call

github.com

src/ph_civic_data_mcp/utils/http.py:36 · url_literal

Packages 1

pypi:ph-civic-data-mcp@0.8.0

server.json:15 · launch:server.json

URLs 484

http://purl.org/dc/elements/1.1/

src/ph_civic_data_mcp/sources/gazette.py:39

https://2025electionresults.comelec.gov.ph

src/ph_civic_data_mcp/server.py:162

https://2025electionresults.comelec.gov.ph

src/ph_civic_data_mcp/sources/comelec.py:40

https://air-quality-api.open-meteo.com/v1/air-quality

src/ph_civic_data_mcp/server.py:89

https://air-quality-api.open-meteo.com/v1/air-quality

src/ph_civic_data_mcp/sources/open_meteo_aq.py:19

https://api.open-meteo.com/v1/forecast

src/ph_civic_data_mcp/sources/pagasa.py:33

https://api.open-meteo.com/v1/forecast

src/ph_civic_data_mcp/sources/pagasa.py:339

https://api.worldbank.org/v2/

src/ph_civic_data_mcp/server.py:124

https://api.worldbank.org/v2/country/PHL/indicator

src/ph_civic_data_mcp/sources/world_bank.py:21