Skip to content

The Cracks Index

by johanvd75-byte · remote · no sign-in to list tools · v0.1.2 · published by GitHub user johanvd75-byte

Read-only MCP server for The Cracks Index: ranks countries and regions on social-safety strength

Changes · 1
CompareRegistry entry

15 tools: 1 change things and 14 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http cracks-index https://api.fynqo.app/mcp/cracks/

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

15 tools

Changes things 1Claude Code: ask
  • indicator_rankingRank all areas by a single chosen indicator.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Rank all areas by a single chosen indicator. Returns every area's value for one indicator, ordered best-first by the direction-corrected ``normalized_score`` (a higher normalised score always means fewer cracks on that indicator). The raw value and unit are included so the figure can be quoted directly. Read-only, area-level aggregates only, no personal data.

    Annotations the server declares

    • title: Rank areas by one indicator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 14Claude Code: allow
  • area_statisticsReturn where one area sits statistically within its own level.No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Return where one area sits statistically within its own level. Places an area against its peer group (all areas at the same level in the latest snapshot): its percentile, the distance from its composite score to the level median, best and worst, and the handful of areas nearest to it by score. Useful for answering "is this area typical, or an outlier?". Read-only, area-level aggregates only, no personal data.

    Annotations the server declares

    • title: Where an area sits statistically
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • compare_countriesCompare the composite score and rank of several countries.No findings

    Why it is in this group

    • The name "compare_countries" says "compare": a word for reading.
    Description, as the server wrote it
    Compare the composite score and rank of several countries. ``iso3_list`` is a list of ISO-3166 alpha-3 country codes.

    Annotations the server declares

    • title: Compare countries
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • compare_gemeentenCompare the social-domain profile of several Dutch municipalities.No findings

    Why it is in this group

    • The name "compare_gemeenten" says "compare": a word for reading.
    Description, as the server wrote it
    Compare the social-domain profile of several Dutch municipalities. Given two to six CBS GM-codes, returns a side-by-side comparison of their four v1 social-domain indicators plus composite score and rank. Useful for an agent answering "how does municipality A compare to B on the social domain". Read-only, no personal data. wmo_pressure and youth_care_load are context only — shown but never scored. CBS aggregates describe an area, not its quality. Netherlands-only.

    Annotations the server declares

    • title: Compare Dutch municipalities on the social domain
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • country_detailReturn one country's score, rank and per-indicator breakdown.No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Return one country's score, rank and per-indicator breakdown.

    Annotations the server declares

    • title: Country detail
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • country_fixReturn the single highest-impact improvement for one country.No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Return the single highest-impact improvement for one country. The Cracks Index names, alongside each country's score, the one change most associated with the fastest improvement, turning a ranking into a constructive, actionable signal. Read-only, no personal data.

    Annotations the server declares

    • title: Country: highest-impact fix
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • gemeente_social_profileReturn the Dutch social-domain profile for one municipality.No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Return the Dutch social-domain profile for one municipality. Given a CBS GM-code, returns that municipality's four v1 social-domain indicators — social-assistance receipt, modelled homelessness, Wmo use and youth-care use — each with its raw value, source and whether it was measured or modelled. The composite score and rank are included for context, alongside the v0-equivalent score. Read-only, no personal data. wmo_pressure and youth_care_load are context only — never folded into the score. CBS aggregates describe an area, not its quality. Netherlands-only: the deeper municipal layer exists for Dutch municipalities.

    Annotations the server declares

    • title: Dutch municipality: social-domain profile
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_cracks_indexReturn the full country ranking for the latest published snapshot.No findings

    Why it is in this group

    • The name "get_cracks_index" says "get": a word for reading.
    Description, as the server wrote it
    Return the full country ranking for the latest published snapshot.

    Annotations the server declares

    • title: Country ranking
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_regionsList sub-national areas in the Cracks Index, ranked within their level.No findings

    Why it is in this group

    • The name "get_regions" says "get": a word for reading.
    Description, as the server wrote it
    List sub-national areas in the Cracks Index, ranked within their level. The index covers sub-national areas as well as countries: EU regions (NUTS-2) and Dutch municipalities. This tool returns those areas with their composite score and rank. Parameters ---------- level : optional Filter by area level: ``nuts2`` (EU regions) or ``gemeente`` (Dutch municipalities). Omit to return all sub-national areas. country_iso3 : optional ISO-3166 alpha-3 country code to restrict the list to one country's areas (e.g. ``NLD``). limit : optional Maximum number of areas to return (1-1000, default 200). Read-only, no personal data. Ranks are within the area's own level.

    Annotations the server declares

    • title: List regions and municipalities
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • improvement_guidanceReturn constructive improvement guidance for one area.No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Return constructive improvement guidance for one area. Given an area identifier — an ISO-3166 alpha-3 country code, an EU NUTS-2 region code or a Dutch municipality CBS GM-code — returns that area's highest-impact improvement lever from the Cracks Index, together with Fynqo's approach to earlier, joined-up coordination and a link to the public "claim your score" page where an organisation can request a deeper local report. Read-only, no personal data. The lever is framed as "the change most associated with improvement". It is general, aggregated guidance, not policy, medical, legal or financial advice, and carries no promise of a guaranteed score gain (sales-engine §3.4, §5).

    Annotations the server declares

    • title: Improvement guidance
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • indicator_correlationsReturn pairwise correlations between the six indicators across areas.No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Return pairwise correlations between the six indicators across areas. Computes the Pearson correlation coefficient between every pair of the six Cracks Index indicators, using each area's direction-corrected normalised score. Adds a short plain-language note naming the strongest relationship. A coefficient near +1 means areas that do well on one indicator tend to do well on the other; near -1 means the opposite. Read-only, area-level aggregates only, no personal data.

    Annotations the server declares

    • title: Indicator correlations
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • methodologyReturn the index methodology: indicators, weights, direction, sources.No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Return the index methodology: indicators, weights, direction, sources.

    Annotations the server declares

    • title: Methodology and sources
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • region_detailReturn one sub-national area: score, rank, indicator breakdown and fix.No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Return one sub-national area: score, rank, indicator breakdown and fix. Given a region code (an EU NUTS-2 code or a Dutch municipality CBS GM-code), returns that area's composite score, its rank within its own level (regions rank against regions, municipalities against municipalities), the per-indicator breakdown and the single highest-impact improvement for the area. Read-only, no personal data.

    Annotations the server declares

    • title: Region detail
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • top_moversReturn the biggest risers and fallers between the two latest snapshots.No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Return the biggest risers and fallers between the two latest snapshots. Compares every area's composite score in the most recent snapshot against the snapshot before it and returns the areas that improved most (``improvers`` — score fell) and worsened most (``decliners`` — score rose). Needs at least two snapshots; returns an explanatory empty payload otherwise. Read-only, area-level aggregates only, no personal data.

    Annotations the server declares

    • title: Biggest risers and fallers
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or untrusted-input or outbound.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write0
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 15:01 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
1
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
none
Authorization servers
none
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • WarnThe whole server

    The endpoint served tools/list without credentials, and the list has 1 tool that changes things (1 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://api.fynqo.app/mcp/cracks/: tools/list returned 15 tools to an anonymous client, including indicator_ranking (write)

    What this check looks for

Install

Pinned to version 0.1.2. Values in angle brackets are yours to fill in.

claude mcp add --transport http cracks-index https://api.fynqo.app/mcp/cracks/

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__cracks-index__get_cracks_index",
      "mcp__cracks-index__compare_countries",
      "mcp__cracks-index__country_detail",
      "mcp__cracks-index__country_fix",
      "mcp__cracks-index__get_regions",
      "mcp__cracks-index__region_detail",
      "mcp__cracks-index__improvement_guidance",
      "mcp__cracks-index__methodology",
      "mcp__cracks-index__score_trends",
      "mcp__cracks-index__top_movers",
      "mcp__cracks-index__indicator_correlations",
      "mcp__cracks-index__area_statistics",
      "mcp__cracks-index__gemeente_social_profile",
      "mcp__cracks-index__compare_gemeenten"
    ],
    "ask": [
      "mcp__cracks-index__indicator_ranking"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as cracks-index. Review it before you use it.