🌦️ meteoswiss-mcp

MCP server for Swiss weather and climate data from MeteoSwiss.

Connects AI models to the SwissMetNet measurement network (160+ stations, 10-minute interval), MeteoSwiss ICON-CH1/CH2-EPS forecasts and climate normals 1991–2020. Part of the swiss-public-data-mcp portfolio.

🇩🇪 Deutsche Version

Demo query (anchor example)

How suitable is next Wednesday for the sports day at Leutschenbach school?

→ meteo_school_check(location="Zürich Oerlikon", activity="Sporttag") returns a 🟢/🟡/🔴 traffic light for each day of the coming week — straight from the MeteoSwiss ICON model.

Combined with swiss-environment-mcp:

How were air quality and weather at Leutschenbach school yesterday?

→ meteo_current(station='REH') + env_nabel_current(station='ZUE') = a complete environmental picture. → More use cases by audience →

Tools (6)

Tool annotations (MCP hints)

All tools carry explicit MCP annotations — relevant for the client approval UI and for the LLM's safety decisions.

Read rules: all 6 tools are readOnly + non-destructive — the server fundamentally cannot write or delete anything. idempotentHint=False marks tools that return different values depending on when they are called.

MCP protocol version

→ Full roadmap & update strategy: docs/roadmap.md

Quick start

Claude Desktop

{
  "mcpServers": {
    "meteoswiss": {
      "command": "uvx",
      "args": ["meteoswiss-mcp"]
    }
  }
}

Claude Desktop (local development)

{
  "mcpServers": {
    "meteoswiss": {
      "command": "uv",
      "args": ["run", "--directory", "/path/to/meteoswiss-mcp", "meteoswiss-mcp"]
    }
  }
}

Cloud / Render.com (Streamable HTTP)

Configuration via ENV variables (the CLI flags --http / --port N still work as an override):

# Local test (safe, loopback only)
MCP_TRANSPORT=streamable-http meteoswiss-mcp

# Container / Render
MCP_TRANSPORT=streamable-http MCP_HOST=0.0.0.0 MCP_ALLOW_ANY_HOST=1 meteoswiss-mcp

Docker / Render

The repo includes a production-ready multi-stage Dockerfile (non-root user, HEALTHCHECK) and a render.yaml blueprint:

# Build + test locally
docker build -t meteoswiss-mcp .
docker run --rm -p 8000:8000 meteoswiss-mcp
curl http://127.0.0.1:8000/health   # → {"status":"ok","service":"meteoswiss-mcp"}

On Render: "New → Blueprint" → select the repo. Defaults (plan starter, Frankfurt, single instance) are set in render.yaml.

Important: numInstances: 1 is set deliberately — sticky-session routing for multi-replica (audit SCALE-002/003) is not yet implemented.

Structured logging

All tool invocations, upstream failures and egress blocks are emitted as JSON events on stderr (stdio-transport safe). Example:

{"tool": "meteo_forecast", "days": 7, "has_coords": false, "event": "tool_invoked", "level": "info", "timestamp": "2026-05-20T07:00:00Z"}
{"tool": "meteo_forecast", "endpoint": "geocoding", "error_type": "HTTPStatusError", "event": "upstream_failed", "level": "warning", "timestamp": "..."}
{"url": "https://evil.example.com/", "method": "GET", "reason": "host not in allow-list", "event": "egress_blocked", "level": "warning", "timestamp": "..."}

HTTP-mode security

• MCP_HOST deliberately defaults to 127.0.0.1 so that --http on a dev laptop is not accidentally exposed to the local subnet (audit finding SEC-016).
• All outgoing HTTP calls (including redirect follows) are validated against an allow-list: data.geo.admin.ch, api.open-meteo.com, geocoding-api.open-meteo.com, opendata.swiss. Other hosts and IP literals (in particular 169.254.169.254, RFC1918) are rejected with EgressBlocked (SEC-004 / SEC-021).
• CORS: disabled by default (same-origin only). Browser clients (e.g. claude.ai web) need MCP_ALLOWED_ORIGINS=<csv> — the Mcp-Session-Id header is then automatically in Access-Control-Expose-Headers (SDK-004).
• API-key auth: disabled by default. In a production HTTP setup, always set MCP_API_KEY=<random> — requests without a valid X-API-Key or Authorization: Bearer … are rejected with 401 (SEC-009 / SEC-013). /health stays open for container health probes.

Example: production HTTP stack

# 32 bytes of randomness as the auth key
export MCP_API_KEY=$(python -c "import secrets; print(secrets.token_urlsafe(32))")

MCP_TRANSPORT=streamable-http \
MCP_HOST=0.0.0.0 \
MCP_ALLOW_ANY_HOST=1 \
MCP_ALLOWED_ORIGINS=https://app.example.com \
MCP_API_KEY="$MCP_API_KEY" \
meteoswiss-mcp

Example queries

School planning