# `io.github.cyanheads/nhtsa-vehicle-safety-mcp-server` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/io.github.cyanheads/nhtsa-vehicle-safety-mcp-server
- JSON: https://anlyon.dev/api/v1/servers/io.github.cyanheads/nhtsa-vehicle-safety-mcp-server
- Version: 0.10.0 (active)
- Publisher: io.github.cyanheads (GitHub account)
- Runs: remote (streamable-http), local (npm)
- Sign-in to list tools: none
- Repository: https://github.com/cyanheads/nhtsa-vehicle-safety-mcp-server
- Metadata from the official MCP Registry, synced 2026-10-21T18:28:33.676Z

Title and description, as the publisher wrote them:

```untrusted-server-text
Decode VINs, search recalls, complaints, crash ratings, and investigations.
```

Scanned 2026-10-21T19:16:20.943Z over streamable-http.

**7 tools: 1 change things and 6 only read.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 0 | deny |
| Can't be undone | irreversible | 0 | ask |
| Changes things | write | 1 | ask |
| Only reads | read | 6 | allow |

## Findings

No check matched anything in these tool definitions.


## Changes things (1)

Creates or changes something that can be changed back. Claude Code: ask.

### `nhtsa_decode_vin`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Decode a Vehicle Identification Number to extract make, model, year, body type, engine, safety equipment, and manufacturing details. Pass a single 17-character VIN string, or an array of up to 50 VINs for batch decode. Partial VINs accepted — use * for unknown positions.
```

## Only reads (6)

Looks things up and changes nothing. Claude Code: allow.

### `nhtsa_get_safety_ratings`

- The name "nhtsa_get_safety_ratings" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Get NCAP crash test ratings and ADAS feature availability for a vehicle. Use when the user specifically wants crash test stars, rollover risk, or wants to compare safety features across vehicles. NCAP data available from 1990+, best coverage for 2011+.
```

### `nhtsa_get_vehicle_safety`

- The name "nhtsa_get_vehicle_safety" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Get a comprehensive safety profile for a vehicle. Combines NCAP crash test ratings, recalls, and complaint summary into a single response. Use as the default when asked about vehicle safety, reliability, or purchase decisions.
```

### `nhtsa_lookup_vehicles`

- The name "nhtsa_lookup_vehicles" says "lookup": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Look up valid makes, models, and vehicle types in NHTSA's database. Use to resolve ambiguous vehicle names, find correct make/model spelling, or discover what models a manufacturer produces.
```

### `nhtsa_search_complaints`

- The name "nhtsa_search_complaints" says "search": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Search consumer safety complaints filed with NHTSA for a specific vehicle. Returns a component breakdown over all matching complaints plus a paginated slice of the most recent complaints. Use for common problems, failure patterns, or owner-reported issues.
```

### `nhtsa_search_investigations`

- The name "nhtsa_search_investigations" says "search": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Search NHTSA defect investigations from the ODI flat file — covering Preliminary Evaluations (PE), Engineering Analyses (EA), Defect Petitions (DP), Recall Queries (RQ), Audit Queries (AQ), and additional ODI types. make, model, and component are structured filters against the investigation record's vehicle associations. All filters are ANDed. Use nhtsaId to fetch one investigation by its exact ID — including the investigationId nhtsa_search_recalls returns for a campaign. Investigations may link to a resulting recall campaign via recallCampaign.
```

### `nhtsa_search_recalls`

- The name "nhtsa_search_recalls" says "search": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Search recall campaigns by vehicle or campaign number. Use for specific recall lookups, recall history for a vehicle, or looking up a known campaign number.
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `nhtsa-vehicle-safety`:

```json
{
  "permissions": {
    "allow": [
      "mcp__nhtsa-vehicle-safety__nhtsa_get_vehicle_safety",
      "mcp__nhtsa-vehicle-safety__nhtsa_search_recalls",
      "mcp__nhtsa-vehicle-safety__nhtsa_search_complaints",
      "mcp__nhtsa-vehicle-safety__nhtsa_get_safety_ratings",
      "mcp__nhtsa-vehicle-safety__nhtsa_search_investigations",
      "mcp__nhtsa-vehicle-safety__nhtsa_lookup_vehicles"
    ],
    "ask": [
      "mcp__nhtsa-vehicle-safety__nhtsa_decode_vin"
    ],
    "deny": []
  }
}
```