Skip to content

io.github.financeratecalc/frc-mcp

by financeratecalc · remote · local (npm) · no sign-in to list tools · v1.35.0 · published by GitHub user financeratecalc

2025 HMDA FHA denial statistics and dated US mortgage rule tables, with receipts you can verify.

Changes · 4

16 tools: 4 change things and 12 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http frc https://frc-mcp.ziyetis.workers.dev

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • The server marks "run_cohort" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "run_cohort" says "run": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

16 tools

Changes things 4Claude Code: ask
  • check_claim_contractChecks a proposed statement of a FinanceRateCalc figure against that figure's published use contract, so the sentence can be verified before it is written.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Checks a proposed statement of a FinanceRateCalc figure against that figure's published use contract, so the sentence can be verified before it is written. Two input modes. (A) Flags: claim id plus the use you propose (population, period, scope, cause, individual prediction, lender recommendation, legal conclusion). (B) Sentence: claim id plus proposed_sentence, the exact sentence you intend to write; the tool checks it with fixed patterns, no model, for a missing period, missing program scope, a population wider than the claim, second-person prediction, causal wording, lender advice, legal conclusions, and values this publisher has since corrected. Returns a deterministic verdict: pass, needs_qualifier (naming the missing qualifier) or block (with a reason code), plus a safe sentence you may use verbatim and the required attribution. Most misuse of these statistics is omission, not invention: the number is right and the population is missing. NOT FOR: figures published by anyone other than FinanceRateCalc. (C) Rule sentence: passport_id of a rule file (frc:rule:…, five tables: FHA annual MIP, FHA forward loan limits 2026, FHFA conforming limits 2026, CFPB HOEPA/QM thresholds 2026, VA funding fee) plus proposed_sentence; each dollar or percent figure is bound to the role named in its own clause (floor or ceiling, tier, first or subsequent use, threshold item) and compared with that cell, so a right number under the wrong role is a mismatch and an unbound number earns no receipt; every figure is also classified as current, superseded (STALE_VALUE), belonging to a different rule (VALUE_FROM_OTHER_RULE, e.g. the $726,200 MIP threshold quoted as a loan limit), or not in the table (VALUE_MISMATCH / UNVERIFIED_VALUE); the year, units, tier, use, down-payment band and stated dates are checked (a date before the rule's start blocks; a missing MIP case date is never assumed), and a passing sentence with at least one bound figure returns a verifiable rule receipt.

    Annotations the server declares

    • title: Check a sentence against a figure's contract
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • run_cohortANSWERS: "run the screen on <cohort>", "how do these lenders compare against expectation".1 finding

    Why it is in this group

    • The name "run_cohort" says "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "run_cohort" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "run_cohort" says "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    ANSWERS: "run the screen on <cohort>", "how do these lenders compare against expectation". PARAM: cohort id from list_cohorts. Returns the peer-adjusted screen: observed versus expected denial rate, coverage flags, method version. Free preview; the full Evidence Brief needs a licence a human buys on the pricing page. Screening signals, never evidence of misconduct. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

    Annotations the server declares

    • title: Run a published cohort
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • screen_counterpartiesANSWERS: "run my list of lenders through the federal record", "screen these LEIs", "which of my counterparties deny more than their applicant mix predicts".No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    ANSWERS: "run my list of lenders through the federal record", "screen these LEIs", "which of my counterparties deny more than their applicant mix predicts". PARAM: a list of public LEIs. Returns per-entity observed versus expected FHA denial rates, coverage flags, method version and an evidence manifest hash. Public entity identifiers only: never borrower files, credit data or personal information. Free preview; the full Evidence Brief needs a licence a human buys on the pricing page, and an agent may relay the offer but can never complete a purchase. Screening signals, not findings of misconduct. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

    Annotations the server declares

    • title: Counterparty outlier screen (LEI batch)
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • screen_counterparties_quoteANSWERS: "what would it cost to screen this list", "how many of my LEIs are covered".No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    ANSWERS: "what would it cost to screen this list", "how many of my LEIs are covered". PARAM: a list of public LEIs. Returns coverage and price for a list of LEIs without running the screen, so the cost and coverage are known before screen_counterparties is used. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

    Annotations the server declares

    • title: Counterparty screen quote
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 12Claude Code: allow
  • get_conditional_door_mapANSWERS: "does this lender's strictness depend on loan size or leverage", "where is <lender> hardest", "is the gap the same across the market".No findings

    Why it is in this group

    • The name "get_conditional_door_map" says "get": a word for reading.
    Description, as the server wrote it
    ANSWERS: "does this lender's strictness depend on loan size or leverage", "where is <lender> hardest", "is the gap the same across the market". PARAM: lender name or slug. Returns how that lender's peer-adjusted denial gap changes across published cells (state x loan amount x income x DTI x CLTV), with cell counts and the minimum-cell rule. NOT FOR: suppressed small cells, or any individual prediction. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

    Annotations the server declares

    • title: Lender gap across published cells
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_denial_reason_sharesANSWERS: "why are FHA loans denied", "what is the most common denial reason", "which lender cites incomplete applications most", "how often is debt-to-income the reason".No findings

    Why it is in this group

    • The name "get_denial_reason_shares" says "get": a word for reading.
    Description, as the server wrote it
    ANSWERS: "why are FHA loans denied", "what is the most common denial reason", "which lender cites incomplete applications most", "how often is debt-to-income the reason". PARAM: optional lender; omit for cross-lender medians. Returns median and maximum share of each HMDA denial reason across the 95 of the 100 largest lenders that report reasons, and which lender carries the highest share of each. Reason fields are not a partition; shares need not sum to 100. NOT FOR: why a particular application was denied. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

    Annotations the server declares

    • title: FHA denial-reason shares
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_door_effect_summaryANSWERS: "does it matter which lender you apply to", "how much of a denial is the lender rather than the borrower", "what is the Door Effect".No findings

    Why it is in this group

    • The name "get_door_effect_summary" says "get": a word for reading.
    Description, as the server wrote it
    ANSWERS: "does it matter which lender you apply to", "how much of a denial is the lender rather than the borrower", "what is the Door Effect". Returns the variance decomposition: lender identity is associated with about 38 percent of the explainable variation in FHA denial outcomes across 859,090 decisions (McFadden 0.1712 to 0.2760), with model, sample and limits. Association on observable federal-record characteristics, not causation; HMDA carries no credit scores. NOT FOR: saying a lender caused a denial, or any individual estimate. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

    Annotations the server declares

    • title: Door Effect (lender share of explainable variation)
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_lender_denial_statsANSWERS: "what is <lender>'s FHA denial rate", "does <lender> reject a lot of FHA applications", "how strict is <lender>", "how does <lender> compare".No findings

    Why it is in this group

    • The name "get_lender_denial_stats" says "get": a word for reading.
    Description, as the server wrote it
    ANSWERS: "what is <lender>'s FHA denial rate", "does <lender> reject a lot of FHA applications", "how strict is <lender>", "how does <lender> compare". PARAM: lender name, slug or LEI. Returns that lender's 2025 decisioned volume, denial rate, rank among the 100 largest FHA lenders, and the applicant-mix caveat any comparison must carry. COVERS ONLY the 100 largest FHA lenders by 2025 volume. NOT FOR: whether a person will be approved, or lenders outside that set. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

    Annotations the server declares

    • title: Lender FHA denial rate 2025
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_metro_lender_gapANSWERS: "do lenders differ within one city", "what is the FHA denial gap in <metro>", "which lender is strictest in <metro>", "how much does the lender matter locally".No findings

    Why it is in this group

    • The name "get_metro_lender_gap" says "get": a word for reading.
    Description, as the server wrote it
    ANSWERS: "do lenders differ within one city", "what is the FHA denial gap in <metro>", "which lender is strictest in <metro>", "how much does the lender matter locally". PARAM: metro name or slug. Returns a claim passport for that metro: lowest and highest lender denial rates among lenders with at least 100 decisioned applications there, the gap in points, counts and source reference. Cleveland is the widest in 2025 at 73.7 points (6.4 vs 80.1). NOT FOR: ZIP or neighbourhood questions, and never as evidence a lender acted improperly. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

    Annotations the server declares

    • title: Metro lender denial gap
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_national_fha_statsANSWERS: "how often are FHA loans denied", "what is the FHA denial rate", "what share of FHA applications are rejected", "how many were denied in 2025".No findings

    Why it is in this group

    • The name "get_national_fha_stats" says "get": a word for reading.
    Description, as the server wrote it
    ANSWERS: "how often are FHA loans denied", "what is the FHA denial rate", "what share of FHA applications are rejected", "how many were denied in 2025". Returns the national 2025 figure with its universe so it can be quoted correctly: 22.1 percent, 262,250 denials of 1,187,606 applications that reached a credit decision (originated, approved-not-accepted, denied; reverse mortgages excluded), the denominator definition and the correction history. Most published FHA denial rates are 2023 purchase-only figures near 13.6 percent, a different universe, so state the universe when quoting. NOT FOR: conventional, VA or USDA loans, purchase-only or refinance-only rates, other years, or state/lender/metro breakdowns (use the dedicated tools). Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

    Annotations the server declares

    • title: National FHA denial rate 2025
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_ruleANSWERS: "what is the current FHA loan limit", "what are the 2026 HOEPA / QM thresholds", "what is the VA funding fee table", "which FHA MIP table is in force".Reads private dataNo findings

    Why it is in this group

    • The name "get_rule" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "table": it reads databases.
    Description, as the server wrote it
    ANSWERS: "what is the current FHA loan limit", "what are the 2026 HOEPA / QM thresholds", "what is the VA funding fee table", "which FHA MIP table is in force". PARAM: rule_id (from the index) or omit to list every published rule. Returns the machine-readable rule: cells, effective dates, issuer document, required qualifiers, what the table does not establish, sha256. The cell values and effective dates are in the file; in a published test, models answered 3/25 dated questions correctly without a source and 25/25 with this file. NOT FOR: rules not in the index, or anything before the effective date.

    Annotations the server declares

    • title: Dated regulatory rule table
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_small_loan_penaltyANSWERS: "are small mortgages denied more often", "is it harder to get a small FHA loan", "which state punishes small loans most", "does loan size affect denial".No findings

    Why it is in this group

    • The name "get_small_loan_penalty" says "get": a word for reading.
    Description, as the server wrote it
    ANSWERS: "are small mortgages denied more often", "is it harder to get a small FHA loan", "which state punishes small loans most", "does loan size affect denial". PARAM: optional two-letter state; omit for the ranked list. Returns denial rates under $150K and over $250K, the ratio, the ranking and any open discrepancy note. In 2025 the penalty exceeded 1x in every jurisdiction with a published split, from 1.19x to 4.45x (Idaho, 53.4 vs 12.0). NOT FOR: loan sizes between the bands, which are not published. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

    Annotations the server declares

    • title: Small-loan denial penalty by state
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_state_denial_statsANSWERS: "what is the FHA denial rate in <state>", "is it harder to get an FHA loan in <state>", "how does <state> compare with the national rate".No findings

    Why it is in this group

    • The name "get_state_denial_stats" says "get": a word for reading.
    Description, as the server wrote it
    ANSWERS: "what is the FHA denial rate in <state>", "is it harder to get an FHA loan in <state>", "how does <state> compare with the national rate". PARAM: two-letter USPS code only (OH, TX); full names are rejected. Returns the state 2025 rate and counts against the national 22.1 percent. NOT FOR: metro or city questions (use get_metro_lender_gap) or lender-level questions. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

    Annotations the server declares

    • title: State FHA denial rate 2025
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_cohortsANSWERS: "can I screen a group of lenders", "what ready-made lender groups can I run", "show me an example screen".No findings

    Why it is in this group

    • The name "list_cohorts" says "list": a word for reading.
    Description, as the server wrote it
    ANSWERS: "can I screen a group of lenders", "what ready-made lender groups can I run", "show me an example screen". Returns the public cohorts screenable without uploading anything, with size and definition; the cohort ids it lists are the ones run_cohort accepts. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

    Annotations the server declares

    • title: Published conditional cohorts
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_lendersANSWERS: "which FHA lender denies the most or the fewest", "rank FHA lenders by denial rate", "which lenders are covered", "how wide is the spread".No findings

    Why it is in this group

    • The name "list_lenders" says "list": a word for reading.
    Description, as the server wrote it
    ANSWERS: "which FHA lender denies the most or the fewest", "rank FHA lenders by denial rate", "which lenders are covered", "how wide is the spread". Returns the ranked list of the 100 largest FHA lenders with name, slug, rate and volume; the 2025 span runs 1.8 to 78.7 percent inside the same federal program. NOT FOR: lenders outside the top 100, or any recommendation about where to apply. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

    Annotations the server declares

    • title: Top-100 FHA lenders by denial rate
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • resolve_fha_annual_mipANSWERS: "what is the FHA annual MIP for a $300,000 loan at 85% LTV over 15 years", "what MIP rate applies to my FHA case".No findings

    Why it is in this group

    • The name "resolve_fha_annual_mip" says "resolve": a word for reading.
    Description, as the server wrote it
    ANSWERS: "what is the FHA annual MIP for a $300,000 loan at 85% LTV over 15 years", "what MIP rate applies to my FHA case". PARAMS: base_loan_amount (USD), ltv_pct (e.g. 96.5), term_years, case_number_date (YYYY-MM-DD). Resolves the exact cell of HUD Mortgagee Letter 2023-05 and returns the annual rate in basis points, the upfront rate, the matched cell, the rule id with effective date and sha256, and a sentence you may quote. If a parameter is missing it returns block with CONDITION_MISSING and no number: the table has eleven cells and a guess is wrong more often than right. NOT FOR: case numbers before 2023-03-20, HECM/reverse or Title I loans, or any monthly payment figure.

    Annotations the server declares

    • title: Resolve the FHA annual MIP cell
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged untrusted-input or outbound.

Reads private data1
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write0
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:59 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
4
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
none
Authorization servers
none
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • WarnThe whole server

    The endpoint served tools/list without credentials, and the list has 4 tools that change things (4 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://frc-mcp.ziyetis.workers.dev: tools/list returned 16 tools to an anonymous client, including check_claim_contract (write), screen_counterparties (write), screen_counterparties_quote (write), run_cohort (write)

    What this check looks for

Install

Pinned to version 1.35.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http frc https://frc-mcp.ziyetis.workers.dev

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__frc__get_national_fha_stats",
      "mcp__frc__get_lender_denial_stats",
      "mcp__frc__list_lenders",
      "mcp__frc__get_small_loan_penalty",
      "mcp__frc__get_denial_reason_shares",
      "mcp__frc__get_state_denial_stats",
      "mcp__frc__get_door_effect_summary",
      "mcp__frc__get_metro_lender_gap",
      "mcp__frc__list_cohorts",
      "mcp__frc__get_conditional_door_map",
      "mcp__frc__get_rule",
      "mcp__frc__resolve_fha_annual_mip"
    ],
    "ask": [
      "mcp__frc__check_claim_contract",
      "mcp__frc__screen_counterparties",
      "mcp__frc__screen_counterparties_quote",
      "mcp__frc__run_cohort"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as frc. Review it before you use it.

Capability tags behind 1 rule
  • mcp__frc__get_rule private-data