Tools

12 tools defined. 4 are active via the FBI CDE API; 8 are decommissioned — the legacy UCR backend (crime-data-api.fr.cloud.gov) was shut down, and those tools return a ServiceUnavailable error on every call with guidance to the FBI CDE website.

Active tools (CDE API)

Decommissioned tools (always return error)

For decommissioned data, consult cde.ucr.cjis.gov or download FBI bulk CSV files.

fbi_get_crime_estimates

Monthly offense rates and raw counts from the FBI CDE summarized endpoint.

• Scope: national, state (requires state_abbr), or agency (requires ORI)
• Offense types: violent-crime, property-crime, robbery, burglary, larceny, motor-vehicle-theft, arson, aggravated-assault, rape, homicide
• Returns per-100k rates and raw actuals by month for the requested date range

fbi_get_agency_offenses

Same CDE summarized endpoint scoped to a single agency, state, or national level.

• Functionally equivalent to fbi_get_crime_estimates with scope="agency" — useful when the agent's mental model is "offenses for this agency" rather than "crime trends"
• Provide ORI for agency scope; state_abbr for state scope

fbi_get_leoka

Law Enforcement Officers Killed and Assaulted (LEOKA) data.

• Two period modes: monthly (by month) or ytd (year-to-date)
• Returns feloniously killed, accidentally killed, and assault counts with circumstance and weapon detail

fbi_get_arson

Redirects to fbi_get_crime_estimates with offense="arson". The dedicated UCR arson endpoint is decommissioned; arson data remains available via the CDE summarized endpoint.

Resources

Features

Built on @cyanheads/mcp-ts-core:

• Declarative tool and resource definitions — single file per primitive, framework handles registration and validation
• Unified error handling — handlers throw, framework catches, classifies, and formats
• Pluggable auth: none, jwt, oauth
• Swappable storage backends: in-memory, filesystem, Supabase, Cloudflare KV/R2/D1
• Structured logging with optional OpenTelemetry tracing
• STDIO and Streamable HTTP transports

FBI Crime Data Explorer-specific:

• CDE API (/cde/summarized/, /cde/leoka/) — the surviving FBI endpoints post-UCR decommission
• Decommissioned tools return a ServiceUnavailable error with a recovery hint pointing to cde.ucr.cjis.gov — agents can report the gap rather than silently failing
• DEMO_KEY works without signing up (rate-limited shared pool); a registered api.data.gov key for production throughput

Getting started

Add the following to your MCP client configuration file. See the FBI CDE API key registration to obtain a key — DEMO_KEY works for exploration but is rate-limited.

{
  "mcpServers": {
    "fbi-crime-mcp-server": {
      "type": "stdio",
      "command": "bunx",
      "args": ["@cyanheads/fbi-crime-mcp-server@latest"],
      "env": {
        "MCP_TRANSPORT_TYPE": "stdio",
        "MCP_LOG_LEVEL": "info",
        "FBI_API_KEY": "your-api-key"
      }
    }
  }
}

Or with npx (no Bun required):

{
  "mcpServers": {
    "fbi-crime-mcp-server": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@cyanheads/fbi-crime-mcp-server@latest"],
      "env": {
        "MCP_TRANSPORT_TYPE": "stdio",
        "MCP_LOG_LEVEL": "info",
        "FBI_API_KEY": "your-api-key"
      }
    }
  }
}

Or with Docker:

{
  "mcpServers": {
    "fbi-crime-mcp-server": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "MCP_TRANSPORT_TYPE=stdio",
        "-e", "FBI_API_KEY=your-api-key",
        "ghcr.io/cyanheads/fbi-crime-mcp-server:latest"
      ]
    }
  }
}

For Streamable HTTP, set the transport and start the server:

MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 FBI_API_KEY=... bun run start:http
# Server listens at http://localhost:3010/mcp

Prerequisites

• Bun v1.3.2 or higher (or Node.js v24+).
• An api.data.gov API key for the FBI CDE API. DEMO_KEY works for testing but is rate-limited to ~1,000 req/hr from a shared pool.

Installation

1. Clone the repository:

git clone https://github.com/cyanheads/fbi-crime-mcp-server.git

2. Navigate into the directory:

cd fbi-crime-mcp-server

3. Install dependencies:

bun install

4. Configure environment:

cp .env.example .env
# edit .env and set FBI_API_KEY

Configuration

All configuration is validated at startup via Zod schemas in src/config/server-config.ts. Key environment variables:

See .env.example for the full list of optional overrides.

Running the server

Local development

• Build and run:

  sh

  Copy

  # One-time build
  bun run rebuild
  
  # Run the built server
  bun run start:stdio
  # or
  bun run start:http
  

• Run checks and tests:

  sh

  Copy

  bun run devcheck   # Lint, format, typecheck, security
  bun run test       # Vitest test suite
  bun run lint:mcp   # Validate MCP definitions against spec
  

Docker

docker build -t fbi-crime-mcp-server .
docker run --rm -e FBI_API_KEY=your-key -p 3010:3010 fbi-crime-mcp-server

The Dockerfile defaults to HTTP transport, stateless session mode, and logs to /var/log/fbi-crime-mcp-server. OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them.

Project structure

Development guide

See CLAUDE.md for development guidelines and architectural rules. The short version:

• Handlers throw, framework catches — no try/catch in tool logic
• Use ctx.log for request-scoped logging, ctx.state for tenant-scoped storage
• Register new tools and resources via the barrels in src/mcp-server/*/definitions/index.ts
• Active tools call the CDE API (/cde/summarized/, /cde/leoka/); decommissioned tools throw serviceUnavailable with a recovery hint
• Wrap FBI API calls: validate raw → normalize to domain type → return output schema; never fabricate missing fields

Contributing

Issues and pull requests are welcome. Run checks and tests before submitting:

bun run devcheck
bun run test

License

Apache-2.0 — see LICENSE for details.