io. github. cyanheads/ cdc-health-mcp-server
by cyanheads · remote · local (npm) · no sign-in to list tools · v0.10.0 · published by GitHub user cyanheads
Search and query CDC public health data — mortality, vaccinations, surveillance, behavioral risk.
5 tools: 1 change things and 4 only read.
Scanned Oct 21, 2026
- Deletes or cancels0Claude Code: deny
- Can't be undone0Claude Code: ask
- Changes things1Claude Code: ask: see these tools
- Only reads4Claude Code: allow: see these tools
2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http cdc-health https://cdc.caseyjhand.com/mcpFindings
Matches of fixed checks, with the text they matched.
The server marks "cdc_query_dataset" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true}; The name "cdc_query_dataset" says "query": a word for reading.
- Infocdc_query_wonder
The description is 2,330 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...ch queued call adding about 16 seconds plus its own query time before it returns."
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
5 tools
Changes things 1Claude Code: ask
cdc_query_datasetExecute a SoQL query against any CDC dataset.1 finding
Why it is in this group
- The name "cdc_query_dataset" says "query": a word for reading.
- The description's first verb is "execute": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "cdc_query_dataset" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true}; The name "cdc_query_dataset" says "query": a word for reading.
Description, as the server wrote it Execute a SoQL query against any CDC dataset. Supports filtering, aggregation, sorting, full-text search, and field selection. Use cdc_discover_datasets to find dataset IDs and cdc_get_dataset_schema to inspect columns before querying.
Annotations the server declares
- readOnlyHint: true
Only reads 4Claude Code: allow
cdc_discover_datasetsSearch the CDC dataset catalog by keyword, category, or tag.No findings
Why it is in this group
- The description's first verb is "search": a word for reading.
Description, as the server wrote it Search the CDC dataset catalog by keyword, category, or tag. Returns IDs, names, truncated descriptions, asset types, column counts, and update timestamps. The catalog also holds charts, maps, stories, files, and links; an entry whose columnCount is 0 is one of those and yields no data from the other tools. Use cdc_get_dataset_schema for the full column list of a chosen dataset.
Annotations the server declares
- readOnlyHint: true
cdc_get_dataset_schemaFetch the column schema for a CDC dataset — names, data types, descriptions, row count, and last-updated timestamp.No findings
Why it is in this group
- The name "cdc_get_dataset_schema" says "get": a word for reading.
Description, as the server wrote it Fetch the column schema for a CDC dataset — names, data types, descriptions, row count, and last-updated timestamp. Returns the first 100 columns by default; wide datasets continue via column_offset. The dataset description is capped at 4,000 characters by default; pass full_description: true for the whole text. Get dataset IDs from cdc_discover_datasets.
Annotations the server declares
- readOnlyHint: true
cdc_list_catalog_vocabularyList the controlled vocabularies cdc_discover_datasets' category and tags filters are matched against — every domain category and domain tag the CDC catalog publishes, each with th…No findings
Why it is in this group
- The name "cdc_list_catalog_vocabulary" says "list": a word for reading.
Description, as the server wrote it List the controlled vocabularies cdc_discover_datasets' category and tags filters are matched against — every domain category and domain tag the CDC catalog publishes, each with the number of entries carrying it. Call it before filtering a search: a value the catalog does not carry matches nothing and returns an empty page, which is indistinguishable from a real value with no results. All categories come back whole; the tag vocabulary runs to roughly 1,600 values, so tags are ranked by entry count and returned one page at a time via tag_limit and tag_offset. Pass filter to narrow both vocabularies to the values whose words contain it.
Annotations the server declares
- readOnlyHint: true
cdc_query_wonderQuery CDC WONDER for national US mortality statistics — deaths, population, and crude/age-adjusted death rates — across its five mortality databases, selected with the database inp…1 finding
Why it is in this group
- The name "cdc_query_wonder" says "query": a word for reading.
Findings
- Info
The description is 2,330 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...ch queued call adding about 16 seconds plus its own query time before it returns."
Description, as the server wrote it Query CDC WONDER for national US mortality statistics — deaths, population, and crude/age-adjusted death rates — across its five mortality databases, selected with the database input: final underlying-cause data for 1999–2020 (the default) or 2018–2024, provisional data running from 2018 through the current year, and two multiple-cause databases covering the same two eras. Break results out by year, age group, sex, and/or race, and filter by ICD-10 cause of death, sex, age group, or year range; on a multiple-cause database, mcd_icd10 additionally matches a cause listed anywhere on the death certificate rather than only the one certified as underlying. Each database holds a different span of years (1999–2026 across all of them) and a request whose year_range falls outside the selected one's span is rejected with that span named. WONDER is a separate CDC system from the Socrata datasets the other cdc_* tools query. Data is national only — sub-national (state/county) breakdowns are not available through the API (CDC vital-statistics policy). Cause of death is a filter, not a grouping. Some measure cells come back as a CDC status token rather than a number — "Suppressed" (withheld for confidentiality), "Unreliable" (a rate from fewer than 20 deaths), or "Not Applicable" (no population denominator); those cells read null in rows and each one is listed in cellNotes with its token. CDC also drops whole rows before sending the table — strata with zero deaths, and strata whose death count is suppressed — so a stratum can be missing from rows entirely; messages carries CDC's statement whenever that happened. Each response is bounded by a 200,000-character budget counted over the whole result, so a broad grouping — one can run past two thousand rows — comes back a page at a time: the response reports the table's totalCount and a nextOffset to continue from, and limit takes smaller pages. Paging shapes the response only — WONDER is asked once either way, and the figures, caveats and hidden-row notices are the same on every page. CDC rejects requests made less than 15 seconds apart across all five databases, so calls are spaced automatically: calls made while another is running wait their turn and run one after another, each queued call adding about 16 seconds plus its own query time before it returns.
Annotations the server declares
- readOnlyHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 0.10.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http cdc-health https://cdc.caseyjhand.com/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__cdc-health__cdc_discover_datasets",
"mcp__cdc-health__cdc_get_dataset_schema",
"mcp__cdc-health__cdc_list_catalog_vocabulary",
"mcp__cdc-health__cdc_query_wonder"
],
"ask": [
"mcp__cdc-health__cdc_query_dataset"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as cdc-health. Review it before you use it.
