Idescat MCP Server
by idescat.cat · remote · no sign-in to list tools · v1.1.0 · published by cat.idescat
Query official statistics of Catalonia (Idescat): tables, metadata and JSON-stat data via MCP.
7 tools: 7 only read.
Scanned Oct 21, 2026
- Deletes or cancels0Claude Code: deny
- Can't be undone0Claude Code: ask
- Changes things0Claude Code: ask
- Only reads7Claude Code: allow: see these tools
1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http idescat https://api.idescat.cat/mcpFindings
Matches of fixed checks, with the text they matched.
- Infoget_table_data
The description is 2,760 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...ult, checking that extension.derived (codes used, warnings) matches the question."
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
7 tools
Only reads 7Claude Code: allow
get_idescat_statObtains information about an Idescat (Statistical Institute of Catalonia) statistic given its acronym.No findings
Why it is in this group
- The name "get_idescat_stat" says "get": a word for reading.
Description, as the server wrote it Obtains information about an Idescat (Statistical Institute of Catalonia) statistic given its acronym. Use it when the user asks about a specific statistic identified by its acronym (for example, CENSPH, EPA, PIBC, AFI, etc.). The 'datasets' field is a key boolean: if true, the statistic is normalized and therefore available in get_idescat_stat_tables and the rest of the table-level tools (metadata, data, divisions, etc.); if false, the statistic is NOT normalized and get_idescat_stat_tables will not recognize it (it would return an identifier error), so the only information available is what this same tool returns ('url', 'time_ref', 'update_date', 'update_title', 'update_text'). To know if a statistic has queryable tables, this tool is enough, without calling get_idescat_stat_tables. The 'url' field is a relative address to https://www.idescat.cat. The 'geo' field is an array with the available geographical disaggregation levels (e.g., 'cat', 'prov', 'at', 'com', 'mun', 'dis', 'sec'). POPULATION FIGURES: when population data is requested, the main and richest source is CENSPH (population and housing census, annual); for semi-annual estimates there is EP (population estimates, semi-annual); and there is also PMH (municipal register of inhabitants, annual). By default, choose CENSPH (or EP if semi-annual data is requested) and NEVER use PMH for population data unless the user explicitly asks for it.
get_idescat_stat_tablesObtains the list of tables for an Idescat statistic given its official acronym.Reads private dataNo findings
Why it is in this group
- The name "get_idescat_stat_tables" says "get": a word for reading.
What it can reach
- private-dataThe name "get_idescat_stat_tables" says "get" and "table": it reads databases.
- private-dataThe description's first sentence says "table": it reads databases.
Description, as the server wrote it Obtains the list of tables for an Idescat statistic given its official acronym. Use it when the user asks what tables or information a statistic has. The response contains a 'tables' array where each element has 'id' (numerical identifier) and 'name' (table title). Present each table as: name (id). Inform the user that they can request more details about a table by indicating its identifier.
get_idescat_statsObtains the complete list of Idescat statistics (all, normalized and non-normalized).No findings
Why it is in this group
- The name "get_idescat_stats" says "get": a word for reading.
Description, as the server wrote it Obtains the complete list of Idescat statistics (all, normalized and non-normalized). It has no parameters. The response contains a 'statistics' array where each element has: 'acronym' (lowercase acronym, e.g., 'censph', to be used as the 'stat' argument of the other tools), 'name' (title), 'description' (summary), 'datasets' (boolean), 'geo' (array of available territorial disaggregations), and 'url' (initial web address, relative to https://www.idescat.cat). Use it when the user asks what statistics are available or when a statistic needs to be found by name or territorial disaggregation. THREE KEY FIELDS to decide the flow: (1) 'datasets' — if true, the statistic is normalized and you can use the rest of the tools (get_idescat_stat_tables, get_table_metadata, get_table_data, get_table_geo, render_table); if false, ONLY the information from this tool and get_idescat_stat is available. (2) 'geo' — available levels of geographical disaggregation (e.g., 'cat'=Catalonia, 'prov'=provinces, 'at'=territorial plan areas, 'com'=counties and Aran, 'mun'=municipalities, 'dis'=districts, 'sec'=census sections). ALWAYS CHECK 'geo' before choosing a statistic for a territorial query: if the user asks for county data, choose a statistic that includes 'com' in 'geo'. (3) 'url' — home page of the statistic on the Idescat website. POPULATION FIGURES: when population data is requested, there are several sources: the main and richest is CENSPH (population and housing census, annual); for semi-annual estimates there is EP (population estimates, semi-annual); and there is also PMH (municipal register of inhabitants, annual). By default, choose CENSPH (or EP if semi-annual data is requested) and NEVER use PMH for population data unless the user explicitly asks for it.
get_table_dataRetrieves the data (values) of an Idescat table in JSON-stat format for a territorial division.Reads private data1 finding
Why it is in this group
- The name "get_table_data" says "get": a word for reading.
What it can reach
- private-dataThe name "get_table_data" says "get" and "table": it reads databases.
- private-dataThe description's first sentence says "retrieve" and "table": it reads databases.
- private-dataThe input names a table (input.table), and the tool reads: it reads databases.
Findings
- Info
The description is 2,760 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...ult, checking that extension.derived (codes used, warnings) matches the question."
Description, as the server wrote it Retrieves the data (values) of an Idescat table in JSON-stat format for a territorial division. You can retrieve the ENTIRE table (without filters) or only a SUBSET by passing the OPTIONAL parameters 'filters' (specific categories per dimension) and/or 'last' (number of last time periods); filtering returns smaller responses and allows querying tables that as a whole would exceed the limit. The filters use the dimension identifiers and category codes (category.index) returned by get_table_metadata (with the same 'geo'). IMPORTANT: the 20,000 cell limit is checked AFTER applying the filters; if it exceeds it, it returns a 'Dataset too large' error and you must add more filters (filters, last). You can call get_table_metadata beforehand to know the dimensions, periods, and category codes. The result contains: 'id' (dimension names in order), 'size' (number of categories per dimension), 'value' (flat array of values), 'dimension' (details per dimension: codes in category.index, labels in category.label, units in category.unit), 'role' (which dimensions are time, geo, or metric), 'status' (marks special values). HOW TO READ 'value' (row-major order): the array is FLAT; the LAST dimension of 'id' varies fastest and the first slowest. To get the value of a combination of categories (one per dimension) follow these 4 steps: (1) for each dimension, look for the POSITION (0-based) of the chosen category in dimension.{nom}.category.index — this 'index' can be a code→position object or a list of codes (the position is the index within the list); ALWAYS use this index, DO NOT assume alphabetical order or by label; (2) the stride of each dimension = product of the 'size' of the SUBSEQUENT dimensions (the last dimension has stride 1); (3) offset = sum of (position × stride) of all dimensions; (4) the searched value is value[offset]. Use the order of the 'id' array in all steps (NOT the order of keys in 'dimension'). EXAMPLE: id=['territory','sex'], size=[3,2], territory.index={BCN:0,GIR:1,LLE:2}, sex.index={M:0,F:1} → strides=[2,1]; for Girona+Woman: offset = 1×2 + 1×1 = 3, i.e., value[3]. Canonical ordering sample: https://json-stat.org/samples/order.json. WARNINGS: 1) null values (data not available) OCCUPY their position within the order: they DO NOT shift the index. 2) 'Base 2024', 'Base 2024=100' or '2024 Statistical Revision' in the title DO NOT indicate estimates; they are only the year of methodological reference and the data are real and definitive unless 'status' indicates otherwise. CALCULATIONS: never add, subtract or compute percentages yourself from the returned values; use filters ranges, sum and derive and report the server's result, checking that extension.derived (codes used, warnings) matches the question.
get_table_geoObtains the list of territorial divisions available for an Idescat table (for example: cat=Catalonia, com=counties and Aran, mun=municipalities, prov=provinces, at=territorial plan…Reads private dataNo findings
Why it is in this group
- The name "get_table_geo" says "get": a word for reading.
What it can reach
- private-dataThe name "get_table_geo" says "get" and "table": it reads databases.
- private-dataThe description's first sentence says "table": it reads databases.
- private-dataThe input names a table (input.table), and the tool reads: it reads databases.
Description, as the server wrote it Obtains the list of territorial divisions available for an Idescat table (for example: cat=Catalonia, com=counties and Aran, mun=municipalities, prov=provinces, at=territorial plan areas). The response contains a 'divisions' array where each element has 'id' (division code) and 'name' (label). Often it is NOT necessary to call it because get_table_metadata already returns these divisions in 'link.related'. Use it only if you need the list of divisions without having called the metadata. The 'id' code is the value to pass to the 'geo' parameter of get_table_metadata, get_table_data, or render_table. If not specified, these tools use the 'cat' division (Catalonia as a whole) by default.
get_table_metadataObtains the metadata for a specific Idescat table in JSON-stat format, given the statistic acronym (stat) and the table identifier (table).Reads private dataNo findings
Why it is in this group
- The name "get_table_metadata" says "get": a word for reading.
What it can reach
- private-dataThe name "get_table_metadata" says "get" and "table": it reads databases.
- private-dataThe description's first sentence says "table": it reads databases.
- private-dataThe input names a table (input.table), and the tool reads: it reads databases.
Description, as the server wrote it Obtains the metadata for a specific Idescat table in JSON-stat format, given the statistic acronym (stat) and the table identifier (table). Use it when the user wants to know the details of a table: dimensions, categories available for each dimension (time periods, territorial scopes, sex, etc.), date of last update, units, etc. The acronym and identifier are previously obtained with get_idescat_stat_tables. At the end of the response, always include this Markdown link (substituting {stat} and {table} in lowercase): [See the results in this table](https://www.idescat.cat/pub/?id={stat}&n={table}). TERRITORIAL DIVISIONS: the response includes 'link.related', an array with other available territorial divisions (provinces, counties, municipalities, etc.); therefore it is often NOT necessary to call get_table_geo. If you pass the 'geo' parameter (for example geo='com' or geo='mun'), you get the metadata for that division, which includes the codes and labels (category.index / category.label) for the geographical dimension and the rest of the dimensions; use these codes directly to build the 'filters' parameter of get_table_data or render_table, without having to test and correct. SIZE CONTROL: check the 'size' field (array): the product of all its elements is the total number of cells. If it exceeds 20,000 (common case for municipal data), DO NOT retrieve the entire table; use get_table_data with filters (filters, last) to reduce the selection. If it is equal to or less than 20,000, you can retrieve it entirely with get_table_data.
render_tableReturns a Markdown table already built with the filtered data from an Idescat table, ready to be shown to the user without having to interpret the JSON-stat.Reads private dataNo findings
Why it is in this group
- The description's first verb is "return": a word for reading.
What it can reach
- private-dataThe name "render_table" says "table": it reads databases.
- private-dataThe description's first sentence says "return" and "table": it reads databases.
- private-dataThe input names a table (input.table), and the tool reads: it reads databases.
Description, as the server wrote it Returns a Markdown table already built with the filtered data from an Idescat table, ready to be shown to the user without having to interpret the JSON-stat. It includes the title, units, the table with category labels, status notes (e.g., provisional data), and ALWAYS a final link to the table on the Idescat website that must be kept in the response to the user. By default, it puts the time dimension in rows and the first dimension with more than one category in columns; this can be changed with the 'rows' and 'cols' parameters. All other dimensions with more than one category must be reduced to a single category with 'filters'. IMPORTANT (error self-correction): if the tool returns the error with 'pending_dimensions', DO NOT change tools: call render_table again adding the 'filters' parameter with a single category for each pending dimension (you can start from the 'suggested_filters' field that comes in the same error response, but choose the appropriate category for the user's question according to 'categories'). If it then returns the size error (maximum 40 rows × 15 columns), follow the 'how_to_fix' field: if the time dimension has too many columns, add the 'last' parameter (e.g., last: 12), and if the rows dimension is too large, filter it with 'filters' or swap 'rows'/'cols'. You can chain 'filters' and 'last' in the same call. The values '..' indicate data not available. CALCULATIONS: never add, subtract or compute percentages yourself from the returned values; use filters ranges, sum and derive and report the server's result, checking that the Calculations notes under the table (codes used, warnings) match the question.
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged untrusted-input or outbound.
- Reads private data5
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write0
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Remote posture
What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.
Looked at Oct 22, 2026, 14:25 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.
- Reachable
- yes
- HTTP status of an anonymous initialize
- 200
- tools/list served without credentials
- yes
- Tools that change things, listed without credentials
- 0
- Protocol version
- 2025-06-18
- WWW-Authenticate on 401
- not observed
- resource_metadata in WWW-Authenticate
- none
- RFC 9728 protected resource metadata
- none
- Authorization servers
- none
- Legacy HTTP+SSE transport
- no
- Dynamic client registration
- not observed
- Client ID metadata documents
- not observed
Install
Pinned to version 1.1.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http idescat https://api.idescat.cat/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__idescat__get_idescat_stats",
"mcp__idescat__get_idescat_stat",
"mcp__idescat__get_idescat_stat_tables",
"mcp__idescat__get_table_metadata",
"mcp__idescat__get_table_data",
"mcp__idescat__get_table_geo",
"mcp__idescat__render_table"
],
"ask": [],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as idescat. Review it before you use it.
Capability tags behind 5 rules
- mcp__idescat__get_idescat_stat_tables private-data
- mcp__idescat__get_table_metadata private-data
- mcp__idescat__get_table_data private-data
- mcp__idescat__get_table_geo private-data
- mcp__idescat__render_table private-data