Skip to content

Offendersearch

app.offendersearch/offendersearchoffendersearch.appstreamable-httpv1.29.1Scanned

Search US sex-offender registries and criminal records, with per-source citations.

10 tools: 3 change things and 7 only read.

Tools: 0 delete, 0 irreversible, 3 write, 7 read.
  • Reads private data · 0
  • Reads text others write · 0
  • Can send data out · 0
  • 3 findings, 1 high

Tools listed without sign-in. Remote posture

Anlyon alternative

3 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

10 tools

Changes things 3Claude Code: ask
  • map_open_recordOpen the complete record behind one map marker, or behind a saved reference.No findings

    Why it is in this group

    • The name "map_open_record" says "open": a word for a change.
    Description, as the server wrote it
    Open the complete record behind one map marker, or behind a saved reference. Returns: { record, recordRef, billing: { billed, unit, reason }, notice }. `record` is the same Record object search_offenders returns. `recordRef` ('mr_...') is a lasting reference: keep it to open the same record later, after the marker id has expired. Billing: one record open per person per map response, at the account's record-open rate (published price $0.035 per open; an account's agreed rate may differ) — so open a marker only when the user wants that person's record, not every marker in a view or along a route. - The same marker id again is free (`reason: 'marker_already_opened'`). - A new map_viewport, map_area, map_route or map_group answer carries new ids; opening the same person from it is a new charge. - Opening by `recordRef` is one record open, then free for 24 hours. A record just opened from a marker is also free by its reference for 24 hours. `billing.billed` says whether THIS open was charged. Marker ids work for 24 hours (410 `marker_expired` after that). A 410 `record_no_longer_listed` means the registry no longer lists the person; it is not billed. Auth: uses the caller's X-API-Key (request header or OFFENDERSEARCH_API_KEY env).
  • map_routeExact counts of registered addresses along one walking or bus route.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    Findings

    • Info

      The description is 2,507 characters long, over the 2,000 this check looks for.

      Matched text

      description ends: "...uses the caller's X-API-Key (request header or OFFENDERSEARCH_API_KEY env)."

      What this check looks for
    Description, as the server wrote it
    Exact counts of registered addresses along one walking or bus route. Counts a corridor either side of the line, a radius around each stop, or both, and returns exact numbers per leg and per stop with nameless pins and their distances. Never an estimate and never partial: the answer is complete or the call fails without a charge. Returns: { shape: 'route', profile, measure, detail, datasetVersion, complete, lengthMiles, corridorMiles, stopRadiusFeet, parcelAllowanceFeet, units, total, corridorTotal, stopsTotal, breakdown {street, housed, homeless, incarcerated}, legs: [ {leg, fromStop, toStop, lengthMiles, count} ], stops: [ {stopId, alongMiles, count, nearestFeet, markerIds} ], markers: [ {id, lat, lng, precision, addressType, distanceMiles, leg, alongMiles, nearestStop, stopDistanceFeet} ], groups[], approximate {count, areas[]}, unplaced {count, states}, externalId, notice, routeNotice }. - `total` = distinct people with a street address in the corridor or a stop's reach; leg counts sum to `corridorTotal`. - Pins carry NO NAMES. A `groups` entry (several people at one address) and an `approximate.areas` entry (people placed only at the middle of a ZIP, city or county; never in `total`) open with map_group. - To see who one marker is, call map_open_record with its `id` — a separate charge at the account's record-open rate (published price $0.035 per open; an account's agreed rate may differ). Open only the records the user asks for, not every marker on the route. - More than 300 pins at detail=full is a 422 `route_too_many_people` that carries the exact counts and is not charged: use detail='count' or split the route. A count shows REGISTERED ADDRESSES, NOT WHERE ANYONE IS, and is not a rating of the route. Never describe a route as safe or unsafe; relay `notice` and `routeNotice`. It supports the user's process; it is not a legal determination. Billing: route units, each one map request ($2 per 1,000): one per started mile of measured corridor plus one per 10 stops when stop radii are measured (minimum 1); `units` in the answer says how many. detail='count' costs the same. E.g. a 17.4-mile bus route with 35 stops = 18 + 4 = 22 units. Test mode is free. The Map API must be turned on for the account. Auth: uses the caller's X-API-Key (request header or OFFENDERSEARCH_API_KEY env).
Only reads 7Show 7 read-only tools
  • get_criminal_coverageList the criminal-record jurisdictions searched, with kind and status.No findings

    Why it is in this group

    • The name "get_criminal_coverage" says "get": a word for reading.
    Description, as the server wrote it
    List the criminal-record jurisdictions searched, with kind and status. Use it to discover which states and counties are reachable and which are answering today, before relying on an empty result. Depth is uneven by design: counties publish independently, so a state with many county jurisdictions is not "better covered" than one that publishes a single statewide source — it is differently structured. Returns the jurisdiction roster; each entry carries its code, the state it belongs to, the kind of records it holds (jail / prison / court / warrant / registry) and whether it is currently answering.
  • get_registry_coverageList every registry we cover plus its scope, legal status, and health.1 finding

    Why it is in this group

    • The name "get_registry_coverage" says "get": a word for reading.

    Findings

    • High

      The description contains "Do NOT tell a user", an instruction to keep something from the user.

      Matched text

      description: "...ords to a freshness='daily' search. Do NOT tell a user their search results are stale, unr..."

      What this check looks for
    Description, as the server wrote it
    List every registry we cover plus its scope, legal status, and health. Public coverage catalog (no API key required). Use it to discover the `jurisdictions` codes accepted by search_offenders / batch_search and to check per-registry freshness/health before relying on a result. Returns: { count, registries: [ SourceInfo ] } where each SourceInfo is: - id: registry code (e.g. 'IL', 'TX', 'PR') - name: human-readable registry name - covers: [state codes] a registry covers ('*' = national / all) - scope: 'state' | 'national' - status: 'live' | 'building' - legal: { commercialUse: 'allowed'|'restricted'|'prohibited'|'unknown' } - health: { lastSuccessAt, typicalLatencyMs, ageSeconds, freshFor } `health` is OPERATIONAL COVERAGE METADATA about our ingest schedule, published for transparency. It is NOT a quality warning about a search result: a search serves every registry's best available data regardless of `freshFor`, so a registry listing only 'weekly' still contributes its records to a freshness='daily' search. Do NOT tell a user their search results are stale, unreliable or out of date on the basis of these fields — they are not. The only completeness signal that belongs in an answer is `counts.sourcesIncomplete` / `warnings[]` from the search response itself.
  • map_areaGet what to draw inside a drawn shape: a polygon, or a line with a buffer.No findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.
    Description, as the server wrote it
    Get what to draw inside a drawn shape: a polygon, or a line with a buffer. The same answer as map_viewport for the shape's bounding box, limited to what is inside the shape, at the same detail levels (clusters, pins, or named pins at zoom 15+). The response adds `shape: 'polygon' | 'route'`. Returns: { shape, mode, zoom, bbox, datasetVersion, total, breakdown {street, housed, homeless, incarcerated}, clusters[], markers[], areas[], unplaced {count, states}, notice }. - A marker with `id: null` and a `groupId` stands for several people at one address: call map_group with that `groupId`. - `areas` are people placed only at the middle of a ZIP, city or county. Never describe them as being at an exact spot. - To see who one marker is, call map_open_record with its `id`. A pin shows a REGISTERED ADDRESS, not a person's current location — say so when you describe a result (`notice` carries the sentence). Billing: one map request per call ($2 per 1,000), whatever the shape holds. Marker and group ids work for 24 hours. The Map API must be turned on for the account (403 `map_not_enabled` otherwise); `sandbox=true` works without it. Auth: uses the caller's X-API-Key (request header or OFFENDERSEARCH_API_KEY env).
  • map_groupList the people behind a many-people pin or an approximate-area pin.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    List the people behind a many-people pin or an approximate-area pin. Returns: { total, page, perPage, totalPages, kind: 'address' | 'area', named, members: [ { id, addressType, label, housingStatus, hasPhoto } ] }. Members carry `label` only when the group id came from a view at zoom 15 or closer (`named: true`). Each member `id` opens with map_open_record. Billing: one map request per page. A group id works for 24 hours and only for the account it was issued to; after that, call map_viewport again. Auth: uses the caller's X-API-Key (request header or OFFENDERSEARCH_API_KEY env).
  • map_viewportGet what to draw for one map view: clusters, pins, or named pins.1 finding

    Why it is in this group

    • The description's first verb is "get": a word for reading.

    Findings

    • Info

      The description is 2,069 characters long, over the 2,000 this check looks for.

      Matched text

      description ends: "...uses the caller's X-API-Key (request header or OFFENDERSEARCH_API_KEY env)."

      What this check looks for
    Description, as the server wrote it
    Get what to draw for one map view: clusters, pins, or named pins. Send the view as `bbox`, or as `lat` + `lng` + `radius_miles`. The detail returned depends on the zoom the view is answered at (the response states it in `zoom`): - zoom 3-12 -> mode 'clusters': a count per grid cell. Each cluster has `count`, `bbox`, `breakdown` and `expansionZoom` (fit the map to `bbox` at that zoom and the cluster comes apart). - zoom 13-14 -> mode 'pins': one pin per address, position only, no name. - zoom 15+ -> mode 'markers': pins with `label` (first initial and last name), `housingStatus`, `hasPhoto`, `registryState`. A close view holding more than 300 pins is answered as clusters instead. Returns: { mode, zoom, bbox, datasetVersion, total, breakdown {street, housed, homeless, incarcerated}, clusters[], markers[], areas[], unplaced {count, states}, notice }. In radius mode also `center`, `radiusMiles` and `withinRadius` (exact), and each marker has `distanceMiles`. - A marker with `id: null` and a `groupId` stands for several people at one address: call map_group with that `groupId`. - `areas` are people placed only at the middle of a ZIP, city or county; each has a `groupId` too. Never describe them as being at an exact spot. - `unplaced` counts people in the states this view touches who have no mappable address. Mention it rather than implying the map shows everyone. - To see who one marker is, call map_open_record with its `id`. A pin shows a REGISTERED ADDRESS, not a person's current location — say so when you describe a result (`notice` carries the sentence). Billing: one map request per call ($2 per 1,000), whatever the view holds. Marker and group ids work for 24 hours. The Map API must be turned on for the account (the API answers 403 `map_not_enabled` otherwise); `sandbox=true` works without it. Auth: uses the caller's X-API-Key (request header or OFFENDERSEARCH_API_KEY env).
  • search_criminalSearch US criminal records — county jail bookings, state prison custody, court cases and warrants.No findings

    Why it is in this group

    • The name "search_criminal" says "search": a word for reading.
    Description, as the server wrote it
    Search US criminal records — county jail bookings, state prison custody, court cases and warrants. Covers county jail rosters, statewide prison systems, court sources, warrant systems and statewide registries across the states, DC and the territories, plus the federal layer — which is a separate system holding offences no state search will surface. A surname is REQUIRED. Supply firstName and a DOB or birth year wherever you have them: a bare common surname returns thousands of people, and the scoring cannot tell you which one is yours. Each record carries `recordType`, and YOU MUST READ IT BEFORE CHARACTERISING ANYONE: - a jail booking is an ARREST-stage record — charges at booking are frequently reduced, dismissed, or never filed. It is NOT a conviction. - prison custody implies a sentence, and therefore a conviction. - a court record carries the DISPOSITION — the authoritative statement of how a case actually ended. - a warrant means the person is SOUGHT. Nothing has been tested. Never describe someone as convicted on the strength of a booking record. Records also carry: name, aliases, dob/birthYear/dobPrecision, sex, race, state, county, custody status and facility, sentence and parole detail, `cases`, `sources` (per-source citation), and `matchConfidence`/`matchBasis` explaining why it matched. `counts.records` is the total found and `counts.recordsReturned` the number in this page. Not a consumer report: results must not be used for FCRA-covered decisions (employment, tenancy, credit) without appropriate process.
  • search_offendersSearch US sex-offender registries for one person and/or location.No findings

    Why it is in this group

    • The name "search_offenders" says "search": a word for reading.
    Description, as the server wrote it
    Search US sex-offender registries for one person and/or location. Fans out across all 58 registries (or the ones named in `jurisdictions`), de-duplicates people across registries, scores each match, and returns the normalized records. Supply whatever identifiers you have — all args are optional but at least a name, location, or free-text `q` should be given. Returns a SearchResponse object (docs/openapi.yaml / FIELD-DICTIONARY.md): - status: 'complete' | 'partial' (partial = a source errored, or a source could not be searched to completion) - counts: { records, sourcesQueried, sourcesIncomplete } - warnings: [str] — ALWAYS present, `[]` when the search ran clean - sourceStatus: [ { source, status, matched, fromCache, note, incomplete, incompleteReason } ] per-registry outcome ★ READ `counts.sourcesIncomplete` BEFORE REPORTING A RESULT. Above 0, `records` is a LOWER BOUND: those registries could not be searched to the end, and an empty or short result is NOT evidence that a person is unregistered. Say so. `warnings[0]` states it in plain language; relay it rather than summarising it away. - records: [ Record ], each with: recordId, matchConfidence, matchBasis[], name {first, middle, last, suffix, full}, aliases[], nicknames[], dob, dobPrecision, age, sex, race, ethnicity, height, weight, eyeColor, hairColor, marks, addresses[{type,line1,city,county,state,zipcode,lat,lng}], offense {crime,statute,riskLevel,tier,convictionDate,...}, flags{absconder,predator}, source {jurisdiction,registryName,recordUrl,scrapedAt,sourceUpdatedAt}, sources[], dobVerification, unverified (offenses[], stateData, images[] are populated only when extensive=true) Auth: uses the caller's X-API-Key (request header or OFFENDERSEARCH_API_KEY env).

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or untrusted-input or outbound.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write0
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Tools listed without sign-in

Looked at Oct 22, 2026, 14:23 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
3
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
not observed
RFC 9728 protected resource metadata
not observed
Authorization servers
not observed
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • WarnThe whole server

    The endpoint served tools/list without credentials, and the list has 3 tools that change things (3 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://mcp.offendersearch.app/mcp: tools/list returned 10 tools to an anonymous client, including batch_search (write), map_route (write), map_open_record (write)

    What this check looks for

Findings

Matches of fixed checks, with the text they matched.

1 high2 info
  • The description contains "Do NOT tell a user", an instruction to keep something from the user.

    Matched text

    description: "...ords to a freshness='daily' search. Do NOT tell a user their search results are stale, unr..."

    What this check looks for
  • The description is 2,069 characters long, over the 2,000 this check looks for.

    Matched text

    description ends: "...uses the caller's X-API-Key (request header or OFFENDERSEARCH_API_KEY env)."

    What this check looks for
  • The description is 2,507 characters long, over the 2,000 this check looks for.

    Matched text

    description ends: "...uses the caller's X-API-Key (request header or OFFENDERSEARCH_API_KEY env)."

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

Install

Pinned to version 1.29.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http offendersearch https://mcp.offendersearch.app/mcp
claude mcp add --transport http offendersearch https://mcp.offendersearch.app/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__offendersearch__search_offenders",
      "mcp__offendersearch__get_registry_coverage",
      "mcp__offendersearch__search_criminal",
      "mcp__offendersearch__get_criminal_coverage",
      "mcp__offendersearch__map_viewport",
      "mcp__offendersearch__map_area",
      "mcp__offendersearch__map_group"
    ],
    "ask": [
      "mcp__offendersearch__batch_search",
      "mcp__offendersearch__map_route",
      "mcp__offendersearch__map_open_record"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as offendersearch. Review it before you use it.

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/app.offendersearch/offendersearch/verify?hash=645a916d0997e488ee4575a7ddfb7c0bdb4e9a74c7e91bf9c405d0c1fabd0272" | jq -e '.changed == false'

Pinned hash 645a916d0997, from Oct 21, 2026, 18:31 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/app.offendersearch/offendersearch/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for app.offendersearch/offendersearch
[![anlyon.dev](https://anlyon.dev/badge/app.offendersearch/offendersearch.svg)](https://anlyon.dev/servers/app.offendersearch/offendersearch)

Source: MCP Registry · repository. Synced Oct 21, 2026, 17:44 UTC.