Offendersearch
by offendersearch.app · remote · no sign-in to list tools · v1.29.1 · published by app.offendersearch
Search US sex-offender registries and criminal records, with per-source citations.
10 tools: 3 change things and 7 only read.
Scanned Oct 21, 2026
- Deletes or cancels0Claude Code: deny
- Can't be undone0Claude Code: ask
- Changes things3Claude Code: ask: see these tools
- Only reads7Claude Code: allow: see these tools
3 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http offendersearch https://mcp.offendersearch.app/mcpFindings
Matches of fixed checks, with the text they matched.
The description contains "Do NOT tell a user", an instruction to keep something from the user.
What this check looks forMatched text
description: "...ords to a freshness='daily' search. Do NOT tell a user their search results are stale, unr..."
- Infomap_viewport
The description is 2,069 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...uses the caller's X-API-Key (request header or OFFENDERSEARCH_API_KEY env)."
- Infomap_route
The description is 2,507 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...uses the caller's X-API-Key (request header or OFFENDERSEARCH_API_KEY env)."
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
10 tools
Changes things 3Claude Code: ask
batch_searchRun many person/location lookups in one call (row-in / row-out).No findings
Why it is in this group
- The name "batch_search" says "search": a word for reading.
- The description's first verb is "run": a word for a change.
Description, as the server wrote it Run many person/location lookups in one call (row-in / row-out). Each row goes through the SAME engine as search_offenders, so a row's records are identical to what a single search would return. A row that fails is reported with status='error' in place and never aborts the batch. Max 1000 rows. Returns: { count, results: [ { index, status, counts{records,sourcesQueried, sourcesIncomplete}, warnings: [str], records: [Record], error? } ] } in input order. ★ A row with `counts.sourcesIncomplete > 0` could not be searched to the end — its `records` are a LOWER BOUND, not a clean 'no match'. Auth: uses the caller's X-API-Key (request header or OFFENDERSEARCH_API_KEY env).
map_open_recordOpen the complete record behind one map marker, or behind a saved reference.No findings
Why it is in this group
- The name "map_open_record" says "open": a word for a change.
Description, as the server wrote it Open the complete record behind one map marker, or behind a saved reference. Returns: { record, recordRef, billing: { billed, unit, reason }, notice }. `record` is the same Record object search_offenders returns. `recordRef` ('mr_...') is a lasting reference: keep it to open the same record later, after the marker id has expired. Billing: one record open per person per map response, at the account's record-open rate (published price $0.035 per open; an account's agreed rate may differ) — so open a marker only when the user wants that person's record, not every marker in a view or along a route. - The same marker id again is free (`reason: 'marker_already_opened'`). - A new map_viewport, map_area, map_route or map_group answer carries new ids; opening the same person from it is a new charge. - Opening by `recordRef` is one record open, then free for 24 hours. A record just opened from a marker is also free by its reference for 24 hours. `billing.billed` says whether THIS open was charged. Marker ids work for 24 hours (410 `marker_expired` after that). A 410 `record_no_longer_listed` means the registry no longer lists the person; it is not billed. Auth: uses the caller's X-API-Key (request header or OFFENDERSEARCH_API_KEY env).
map_routeExact counts of registered addresses along one walking or bus route.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Findings
- Info
The description is 2,507 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...uses the caller's X-API-Key (request header or OFFENDERSEARCH_API_KEY env)."
Description, as the server wrote it Exact counts of registered addresses along one walking or bus route. Counts a corridor either side of the line, a radius around each stop, or both, and returns exact numbers per leg and per stop with nameless pins and their distances. Never an estimate and never partial: the answer is complete or the call fails without a charge. Returns: { shape: 'route', profile, measure, detail, datasetVersion, complete, lengthMiles, corridorMiles, stopRadiusFeet, parcelAllowanceFeet, units, total, corridorTotal, stopsTotal, breakdown {street, housed, homeless, incarcerated}, legs: [ {leg, fromStop, toStop, lengthMiles, count} ], stops: [ {stopId, alongMiles, count, nearestFeet, markerIds} ], markers: [ {id, lat, lng, precision, addressType, distanceMiles, leg, alongMiles, nearestStop, stopDistanceFeet} ], groups[], approximate {count, areas[]}, unplaced {count, states}, externalId, notice, routeNotice }. - `total` = distinct people with a street address in the corridor or a stop's reach; leg counts sum to `corridorTotal`. - Pins carry NO NAMES. A `groups` entry (several people at one address) and an `approximate.areas` entry (people placed only at the middle of a ZIP, city or county; never in `total`) open with map_group. - To see who one marker is, call map_open_record with its `id` — a separate charge at the account's record-open rate (published price $0.035 per open; an account's agreed rate may differ). Open only the records the user asks for, not every marker on the route. - More than 300 pins at detail=full is a 422 `route_too_many_people` that carries the exact counts and is not charged: use detail='count' or split the route. A count shows REGISTERED ADDRESSES, NOT WHERE ANYONE IS, and is not a rating of the route. Never describe a route as safe or unsafe; relay `notice` and `routeNotice`. It supports the user's process; it is not a legal determination. Billing: route units, each one map request ($2 per 1,000): one per started mile of measured corridor plus one per 10 stops when stop radii are measured (minimum 1); `units` in the answer says how many. detail='count' costs the same. E.g. a 17.4-mile bus route with 35 stops = 18 + 4 = 22 units. Test mode is free. The Map API must be turned on for the account. Auth: uses the caller's X-API-Key (request header or OFFENDERSEARCH_API_KEY env).
Only reads 7Claude Code: allow
get_criminal_coverageList the criminal-record jurisdictions searched, with kind and status.No findings
Why it is in this group
- The name "get_criminal_coverage" says "get": a word for reading.
Description, as the server wrote it List the criminal-record jurisdictions searched, with kind and status. Use it to discover which states and counties are reachable and which are answering today, before relying on an empty result. Depth is uneven by design: counties publish independently, so a state with many county jurisdictions is not "better covered" than one that publishes a single statewide source — it is differently structured. Returns the jurisdiction roster; each entry carries its code, the state it belongs to, the kind of records it holds (jail / prison / court / warrant / registry) and whether it is currently answering.
get_registry_coverageList every registry we cover plus its scope, legal status, and health.1 finding
Why it is in this group
- The name "get_registry_coverage" says "get": a word for reading.
Findings
- High
The description contains "Do NOT tell a user", an instruction to keep something from the user.
What this check looks forMatched text
description: "...ords to a freshness='daily' search. Do NOT tell a user their search results are stale, unr..."
Description, as the server wrote it List every registry we cover plus its scope, legal status, and health. Public coverage catalog (no API key required). Use it to discover the `jurisdictions` codes accepted by search_offenders / batch_search and to check per-registry freshness/health before relying on a result. Returns: { count, registries: [ SourceInfo ] } where each SourceInfo is: - id: registry code (e.g. 'IL', 'TX', 'PR') - name: human-readable registry name - covers: [state codes] a registry covers ('*' = national / all) - scope: 'state' | 'national' - status: 'live' | 'building' - legal: { commercialUse: 'allowed'|'restricted'|'prohibited'|'unknown' } - health: { lastSuccessAt, typicalLatencyMs, ageSeconds, freshFor } `health` is OPERATIONAL COVERAGE METADATA about our ingest schedule, published for transparency. It is NOT a quality warning about a search result: a search serves every registry's best available data regardless of `freshFor`, so a registry listing only 'weekly' still contributes its records to a freshness='daily' search. Do NOT tell a user their search results are stale, unreliable or out of date on the basis of these fields — they are not. The only completeness signal that belongs in an answer is `counts.sourcesIncomplete` / `warnings[]` from the search response itself.
map_areaGet what to draw inside a drawn shape: a polygon, or a line with a buffer.No findings
Why it is in this group
- The description's first verb is "get": a word for reading.
Description, as the server wrote it Get what to draw inside a drawn shape: a polygon, or a line with a buffer. The same answer as map_viewport for the shape's bounding box, limited to what is inside the shape, at the same detail levels (clusters, pins, or named pins at zoom 15+). The response adds `shape: 'polygon' | 'route'`. Returns: { shape, mode, zoom, bbox, datasetVersion, total, breakdown {street, housed, homeless, incarcerated}, clusters[], markers[], areas[], unplaced {count, states}, notice }. - A marker with `id: null` and a `groupId` stands for several people at one address: call map_group with that `groupId`. - `areas` are people placed only at the middle of a ZIP, city or county. Never describe them as being at an exact spot. - To see who one marker is, call map_open_record with its `id`. A pin shows a REGISTERED ADDRESS, not a person's current location — say so when you describe a result (`notice` carries the sentence). Billing: one map request per call ($2 per 1,000), whatever the shape holds. Marker and group ids work for 24 hours. The Map API must be turned on for the account (403 `map_not_enabled` otherwise); `sandbox=true` works without it. Auth: uses the caller's X-API-Key (request header or OFFENDERSEARCH_API_KEY env).
map_groupList the people behind a many-people pin or an approximate-area pin.No findings
Why it is in this group
- The description's first verb is "list": a word for reading.
Description, as the server wrote it List the people behind a many-people pin or an approximate-area pin. Returns: { total, page, perPage, totalPages, kind: 'address' | 'area', named, members: [ { id, addressType, label, housingStatus, hasPhoto } ] }. Members carry `label` only when the group id came from a view at zoom 15 or closer (`named: true`). Each member `id` opens with map_open_record. Billing: one map request per page. A group id works for 24 hours and only for the account it was issued to; after that, call map_viewport again. Auth: uses the caller's X-API-Key (request header or OFFENDERSEARCH_API_KEY env).
map_viewportGet what to draw for one map view: clusters, pins, or named pins.1 finding
Why it is in this group
- The description's first verb is "get": a word for reading.
Findings
- Info
The description is 2,069 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...uses the caller's X-API-Key (request header or OFFENDERSEARCH_API_KEY env)."
Description, as the server wrote it Get what to draw for one map view: clusters, pins, or named pins. Send the view as `bbox`, or as `lat` + `lng` + `radius_miles`. The detail returned depends on the zoom the view is answered at (the response states it in `zoom`): - zoom 3-12 -> mode 'clusters': a count per grid cell. Each cluster has `count`, `bbox`, `breakdown` and `expansionZoom` (fit the map to `bbox` at that zoom and the cluster comes apart). - zoom 13-14 -> mode 'pins': one pin per address, position only, no name. - zoom 15+ -> mode 'markers': pins with `label` (first initial and last name), `housingStatus`, `hasPhoto`, `registryState`. A close view holding more than 300 pins is answered as clusters instead. Returns: { mode, zoom, bbox, datasetVersion, total, breakdown {street, housed, homeless, incarcerated}, clusters[], markers[], areas[], unplaced {count, states}, notice }. In radius mode also `center`, `radiusMiles` and `withinRadius` (exact), and each marker has `distanceMiles`. - A marker with `id: null` and a `groupId` stands for several people at one address: call map_group with that `groupId`. - `areas` are people placed only at the middle of a ZIP, city or county; each has a `groupId` too. Never describe them as being at an exact spot. - `unplaced` counts people in the states this view touches who have no mappable address. Mention it rather than implying the map shows everyone. - To see who one marker is, call map_open_record with its `id`. A pin shows a REGISTERED ADDRESS, not a person's current location — say so when you describe a result (`notice` carries the sentence). Billing: one map request per call ($2 per 1,000), whatever the view holds. Marker and group ids work for 24 hours. The Map API must be turned on for the account (the API answers 403 `map_not_enabled` otherwise); `sandbox=true` works without it. Auth: uses the caller's X-API-Key (request header or OFFENDERSEARCH_API_KEY env).
search_criminalSearch US criminal records — county jail bookings, state prison custody, court cases and warrants.No findings
Why it is in this group
- The name "search_criminal" says "search": a word for reading.
Description, as the server wrote it Search US criminal records — county jail bookings, state prison custody, court cases and warrants. Covers county jail rosters, statewide prison systems, court sources, warrant systems and statewide registries across the states, DC and the territories, plus the federal layer — which is a separate system holding offences no state search will surface. A surname is REQUIRED. Supply firstName and a DOB or birth year wherever you have them: a bare common surname returns thousands of people, and the scoring cannot tell you which one is yours. Each record carries `recordType`, and YOU MUST READ IT BEFORE CHARACTERISING ANYONE: - a jail booking is an ARREST-stage record — charges at booking are frequently reduced, dismissed, or never filed. It is NOT a conviction. - prison custody implies a sentence, and therefore a conviction. - a court record carries the DISPOSITION — the authoritative statement of how a case actually ended. - a warrant means the person is SOUGHT. Nothing has been tested. Never describe someone as convicted on the strength of a booking record. Records also carry: name, aliases, dob/birthYear/dobPrecision, sex, race, state, county, custody status and facility, sentence and parole detail, `cases`, `sources` (per-source citation), and `matchConfidence`/`matchBasis` explaining why it matched. `counts.records` is the total found and `counts.recordsReturned` the number in this page. Not a consumer report: results must not be used for FCRA-covered decisions (employment, tenancy, credit) without appropriate process.
search_offendersSearch US sex-offender registries for one person and/or location.No findings
Why it is in this group
- The name "search_offenders" says "search": a word for reading.
Description, as the server wrote it Search US sex-offender registries for one person and/or location. Fans out across all 58 registries (or the ones named in `jurisdictions`), de-duplicates people across registries, scores each match, and returns the normalized records. Supply whatever identifiers you have — all args are optional but at least a name, location, or free-text `q` should be given. Returns a SearchResponse object (docs/openapi.yaml / FIELD-DICTIONARY.md): - status: 'complete' | 'partial' (partial = a source errored, or a source could not be searched to completion) - counts: { records, sourcesQueried, sourcesIncomplete } - warnings: [str] — ALWAYS present, `[]` when the search ran clean - sourceStatus: [ { source, status, matched, fromCache, note, incomplete, incompleteReason } ] per-registry outcome ★ READ `counts.sourcesIncomplete` BEFORE REPORTING A RESULT. Above 0, `records` is a LOWER BOUND: those registries could not be searched to the end, and an empty or short result is NOT evidence that a person is unregistered. Say so. `warnings[0]` states it in plain language; relay it rather than summarising it away. - records: [ Record ], each with: recordId, matchConfidence, matchBasis[], name {first, middle, last, suffix, full}, aliases[], nicknames[], dob, dobPrecision, age, sex, race, ethnicity, height, weight, eyeColor, hairColor, marks, addresses[{type,line1,city,county,state,zipcode,lat,lng}], offense {crime,statute,riskLevel,tier,convictionDate,...}, flags{absconder,predator}, source {jurisdiction,registryName,recordUrl,scrapedAt,sourceUpdatedAt}, sources[], dobVerification, unverified (offenses[], stateData, images[] are populated only when extensive=true) Auth: uses the caller's X-API-Key (request header or OFFENDERSEARCH_API_KEY env).
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or untrusted-input or outbound.
- Reads private data0
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write0
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Remote posture
What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.
Looked at Oct 22, 2026, 14:23 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.
- Reachable
- yes
- HTTP status of an anonymous initialize
- 200
- tools/list served without credentials
- yes
- Tools that change things, listed without credentials
- 3
- Protocol version
- 2025-06-18
- WWW-Authenticate on 401
- not observed
- resource_metadata in WWW-Authenticate
- none
- RFC 9728 protected resource metadata
- none
- Authorization servers
- none
- Legacy HTTP+SSE transport
- no
- Dynamic client registration
- not observed
- Client ID metadata documents
- not observed
- WarnThe whole server
The endpoint served tools/list without credentials, and the list has 3 tools that change things (3 write). Whether a call also works without credentials was not tested: tools are never called.
What this check looks forMatched text
https://mcp.offendersearch.app/mcp: tools/list returned 10 tools to an anonymous client, including batch_search (write), map_route (write), map_open_record (write)
Install
Pinned to version 1.29.1. Values in angle brackets are yours to fill in.
claude mcp add --transport http offendersearch https://mcp.offendersearch.app/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__offendersearch__search_offenders",
"mcp__offendersearch__get_registry_coverage",
"mcp__offendersearch__search_criminal",
"mcp__offendersearch__get_criminal_coverage",
"mcp__offendersearch__map_viewport",
"mcp__offendersearch__map_area",
"mcp__offendersearch__map_group"
],
"ask": [
"mcp__offendersearch__batch_search",
"mcp__offendersearch__map_route",
"mcp__offendersearch__map_open_record"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as offendersearch. Review it before you use it.