nhtsa-vehicle-safety-mcp-server

<div align="center"> <h1>@cyanheads/nhtsa-vehicle-safety-mcp-server</h1> <p><b>Decode VINs, search recalls, complaints, crash ratings, and investigations via MCP. STDIO or Streamable HTTP.</b> <div>7 Tools</div> </p> </div> <div align="center">

</div> <div align="center">

</div> <div align="center">

Public Hosted Server: https://nhtsa.caseyjhand.com/mcp

</div>

---

Overview

Vehicle safety data from NHTSA: recalls, consumer complaints, NCAP crash ratings, defect investigations, and VIN decoding. Get a full safety picture for any make, model, and year in one call, or decode a VIN.

Tools

| Tool | Description | |:---|:---| | nhtsa_get_vehicle_safety | Comprehensive safety profile combining crash test ratings, recalls, and complaint summary with per-section availability status. | | nhtsa_search_recalls | Search recall campaigns by vehicle or campaign number with optional date filtering. | | nhtsa_search_complaints | Consumer safety complaints with component breakdown and severity stats. | | nhtsa_get_safety_ratings | NCAP crash test ratings and ADAS feature availability. | | nhtsa_decode_vin | Decode VINs for make, model, year, engine, safety equipment (single or batch up to 50). | | nhtsa_search_investigations | Search NHTSA defect investigations (PE, EA, DP, RQ, AQ, and more) with cached index. | | nhtsa_lookup_vehicles | Look up valid makes, models, vehicle types, and manufacturer details from VPIC. |

Capability reference

nhtsa_get_vehicle_safety _tool

• Combines NCAP crash test ratings, recall history, and complaint summary in a single response
• Frontal crash, side crash, and rollover ratings per vehicle variant
• Recall consequence text plus the do-not-drive, park-outside, and over-the-air-update advisories
• Complaint breakdown by component with crash, fire, injury, and death counts
• Returns sectionStatus (available/partial/unavailable per section) plus warnings so a partial NHTSA outage is not mistaken for a clean record

---

nhtsa_search_recalls _tool

• Look up by make/model/year or by specific NHTSA campaign number — the two are mutually exclusive
• Campaign lookups return every make/model the campaign covers, plus the ODI investigation that preceded it
• Optional inclusive dateRange bounds (after/before, calendar-valid YYYY-MM-DD) apply in both modes; blank bounds are unset
• Includes do-not-drive advisories, park-outside warnings, and OTA update availability

---

nhtsa_search_complaints _tool

• Component breakdown covers every matching complaint regardless of pagination; up to 50 complaint narratives per page (default 20), offset pagination, sorted by filing date descending
• Optional component filter matches within comma-separated component lists (e.g., "ENGINE", "AIR BAGS")
• Every component line includes crash, fire, injury, and death totals, including zeros; individual complaints preserve fields NHTSA actually reported
• An incident date NHTSA reported that the complaint's own filing date or model year rules out is disclosed as unreliableIncidentDate rather than served as the incident date

---

nhtsa_get_safety_ratings _tool

• Accepts either make + model + modelYear, or a follow-up vehicleId from an earlier result; combining the modes is rejected
• Frontal crash, side crash (barrier + pole), and rollover ratings, plus ESC/forward-collision/lane-departure ADAS availability
• Per-record complaint, recall, and investigation counts are variant-scoped — not vehicle-level totals
• NCAP coverage starts at 1990, most complete for 2011+ model years

---

nhtsa_decode_vin _tool

• Single VIN or batch of up to 50; partial VINs accepted using * for unknown positions; any blank entry rejects the whole batch before decoding
• Optional modelYear helps disambiguate pre-1980 or partial VINs
• Preserves sparse VPIC fields instead of filling missing data with placeholders
• Every result carries VPIC's own errorCode/errorText decode-quality signal, including the clean "0" case

---

nhtsa_search_investigations _tool

• Investigation types: Preliminary Evaluations (PE), Engineering Analyses (EA), Defect Petitions (DP), Recall Queries (RQ), Audit Queries (AQ), and additional ODI codes (SQ, EQ, RP, and others)
• Free-text search across investigation IDs, subjects, and summaries, plus structured make, model, and component filters — all ANDed
• Inclusive openDateRange and closeDateRange bounds (after/before, calendar-valid YYYY-MM-DD) filter before counting and pagination; active bounds exclude records without the corresponding usable date
• nhtsaId fetches one investigation by its exact ID, mutually exclusive with the other filters — the reverse of the recall link, closing the campaign-to-investigation round trip
• Sourced from NHTSA's ODI bulk file (FLAT_INV.zip) — concurrent cold queries share one streaming load with a two-minute deadline. Cancelling one query leaves other callers running; successful loads remain cached for 24 hours from completion
• Up to 25 investigations per page (default 20), offset pagination

---

nhtsa_lookup_vehicles _tool

• Four operations: makes, models, vehicle_types, manufacturer — partial match supported on make/manufacturer names
• models can be filtered by year; models and vehicle_types both require make
• Each operation rejects inactive filters: makes accepts none, models accepts make/modelYear, vehicle_types accepts make, and manufacturer accepts manufacturer. Optional blank strings are unset; operation-required make/manufacturer names must be nonblank
• Up to 200 results per page (default 100), offset pagination
• manufacturer lookups stop at a 500-record ceiling and disclose truncated when more may exist — VPIC publishes no match total

Features

Built on @cyanheads/mcp-ts-core: stdio and Streamable HTTP transports, pluggable auth (none / jwt / oauth), swappable storage (in-memory, filesystem, Supabase, Cloudflare KV/R2/D1), structured logging with optional OpenTelemetry tracing.

NHTSA-specific:

• Type-safe client wrapping four NHTSA JSON APIs with retry logic and sparse-field normalization, plus a streaming parser for the ODI investigations bulk file
• Investigation index caching (24h TTL) for fast repeated queries
• No API key required — all NHTSA APIs are public

Agent-friendly output:

• Provenance: every tool echoes effectiveQuery in its enrichment block, so callers can verify exactly what was searched
• Graceful partial failure: nhtsa_get_vehicle_safety returns sectionStatus per section plus warnings, so a partial NHTSA outage isn't mistaken for a clean safety record
• Discriminated outputs: unreliableIncidentDate (complaints), VIN decode errorCode/errorText, and manufacturer-lookup truncated disclose data-quality limits rather than silently omitting or fabricating values

Getting started

Public Hosted Instance

A public instance is available at https://nhtsa.caseyjhand.com/mcp — no installation required. Point any MCP client at it via Streamable HTTP:

{
  "mcpServers": {
    "nhtsa-vehicle-safety-mcp-server": {
      "type": "streamable-http",
      "url": "https://nhtsa.caseyjhand.com/mcp"
    }
  }
}

Self-Hosted / Local

Add the following to your MCP client configuration file:

{
  "mcpServers": {
    "nhtsa-vehicle-safety-mcp-server": {
      "type": "stdio",
      "command": "bunx",
      "args": ["@cyanheads/nhtsa-vehicle-safety-mcp-server@latest"],
      "env": {
        "MCP_TRANSPORT_TYPE": "stdio",
        "MCP_LOG_LEVEL": "info"
      }
    }
  }
}

Or with npx (no Bun required):

{
  "mcpServers": {
    "nhtsa-vehicle-safety-mcp-server": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@cyanheads/nhtsa-vehicle-safety-mcp-server@latest"],
      "env": {
        "MCP_TRANSPORT_TYPE": "stdio",
        "MCP_LOG_LEVEL": "info"
      }
    }
  }
}

Or with Docker:

{
  "mcpServers": {
    "nhtsa-vehicle-safety-mcp-server": {
      "type": "stdio",
      "command": "docker",
      "args": ["run", "-i", "--rm", "-e", "MCP_TRANSPORT_TYPE=stdio", "ghcr.io/cyanheads/nhtsa-vehicle-safety-mcp-server:latest"]
    }
  }
}

For Streamable HTTP, set the transport and start the server:

MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http
# Server listens at http://localhost:3010/mcp

Prerequisites

• Bun v1.4.0 or higher (or Node.js >= 24.0.0)

Installation

1. Clone the repository:

git clone https://github.com/cyanheads/nhtsa-vehicle-safety-mcp-server.git

2. Navigate into the directory:

cd nhtsa-vehicle-safety-mcp-server

3. Install dependencies:

bun install

4. Configure environment (optional):

cp .env.example .env
# edit .env to override transport, auth, or storage defaults — no API key required

Configuration

No API keys required — all NHTSA APIs are public.

| Variable | Description | Default | |:---------|:------------|:--------| | MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio | | MCP_HTTP_HOST | HTTP server host. | 127.0.0.1 | | MCP_HTTP_PORT | HTTP server port. | 3010 | | MCP_HTTP_ENDPOINT_PATH | HTTP endpoint path. | /mcp | | MCP_AUTH_MODE | Auth mode: none, jwt, or oauth. | none | | MCP_SESSION_MODE | HTTP session posture: auto, stateful, or stateless. The server declares stateless in code — it keeps no per-session state — and this variable overrides that. | stateless | | MCP_LOG_LEVEL | Log level (RFC 5424). | info | | LOG_TOOL_FAILURE_PAYLOADS | Log each failed tool call's arguments and result, redacted by key name and capped at `LOG_TOOL_FAILURE_PAYLOAD_MAX