EPA AirNow MCP — official US real-time AQI + forecast (free key)
Four well-defined tools with complete input schemas and clear descriptions. Tool names follow verb_noun convention (current_by_*, forecast_by_*, observations_in_*). All parameters have type definitions and descriptions. Descriptions are substantive (100 - 200 chars), explaining WHAT the tool does and WHEN to use it. Output schemas are documented in code (normalizeObservation function). However, no output schema is formally declared in the tool definitions themselves, LLMs cannot see what fields to expect. Error handling is present but minimal (no recovery guidance). No enum constraints on data_type parameter. Missing parameter validation rules (e.g., ZIP code format, bbox format, date format). No idempotency hints or destructive operation markers.
Latest observed AQI for the AirNow station nearest a lat/lon.
Latest observed AQI for a US ZIP code. Returns one record per pollutant reported at the nearest site (typically O3 + PM2.5). Includes AQI value, category (Good / Moderate / etc.), reporting area, and timestamp.
AQI forecast for a US ZIP code on a given date (defaults to today). Useful for "is tomorrow ok for outdoor activity" decisions.
Historical AQI observations inside a bounding box for a date range. Specify pollutants as comma-separated parameter codes (e.g., "OZONE,PM25,PM10,CO,NO2,SO2"). bbox format: "minLon,minLat,maxLon,maxLat".
Output schemas not declared in tool definitions. LLMs cannot see what fields (date, aqi, category, etc.) the tools return, forcing them to guess or make extra calls.
observations_in_bbox data_type parameter lacks enum constraint. Description says 'A | C | B' but no formal enum in schema, LLMs may pass invalid values like 'both' or 'aqi'.
No parameter validation rules documented. ZIP code format (5 digits), bbox format (minLon,minLat,maxLon,maxLat), and date format (YYYY-MM-DD) are mentioned but not enforced or validated with clear error messages.
Error handling lacks recovery guidance. Errors like 'AirNow: unauthorized' or 'rate-limit' do not tell the LLM what to do next (e.g., 'Contact operator for API key' or 'Retry in 60 seconds').
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 62 | 2026-07-28+ | v2 |
API key injection via _apiKey parameter is non-standard. MCP spec recommends server-side secret injection via environment variables or vault, not tool parameters, to prevent credential leakage in logs.