← Index

io.github.cyanheads/inaturalist-mcp-server

io.github.cyanheads/inaturalist-mcp-serverv0.3.2Search

Search iNaturalist sightings, identification threads, phenology, and look-alike species.

The current version, v0.3.2, was published to the official MCP registry on 2026-11-01. It is distributed as @cyanheads/inaturalist-mcp-server on npm and as a hosted remote over streamable-http, filed under Search by this index, and declares 11 environment variables. Removals and unreachable sources are measured across every server this index tracks, contract drift across the servers that answer in consecutive snapshots; the index's current counts put this record in context.

In-path gate · all MCP tools

Using io.github.cyanheads/inaturalist-mcp-server in Claude, Cursor, Gemini CLI, Cline, or Zed?

MCP tool contracts can change remotely with no version bump. The mcpindex gate pins each contract and HOLDs the call when it drifts-before your agent acts. Zero credentials. This is not the package install for this server itself (use Install this server for that).

Install the mcpindex gate (one command)

Rewrites your MCP host config so each server launches behind the gate. Inspect first: curl -fsSL https://mcpindex.ai/install.sh | less

uv tool install mcpindex-gate && mcpindex-config-wire
Trust verdict · v1 advisory · method
REVIEWstatus: PARTIALfresh until 2026-11-11 02:22 UTC
screened 2026-09-20tier: scannedgranularity: description-levelsource: registry

Semantic screen found no manipulation pattern in the description. Conformance probe not yet run.

mcpindex.integrity.descriptionpassINFO

evidence“Normal public data search”via static_description

Limits of this verdict
  • - Semantic screen only - the deterministic conformance probe has not run on this server
  • - Confidence is reported but not yet calibrated (v1)
  • - Screen reads the tool description, not the live behavior
  • - advisory
  • - registry description only no input schema
  • - screen model 8b
  • - Still current: the description we screened is unchanged, re-checked against the registry
  • - The registry listing (version, packages, links) changed after this screen ran - the description we assessed did not

Semantic screen: an LLM judge reads the tool description for hidden instructions (status PARTIAL). A pass means the description is not lying, not that the tool is safe: a high-capability tool with an honest description still warrants caution. The deterministic conformance probe has not been run on this server yet, so the screen here is semantic-only. Posture: advisory. Confidences are reported but not yet calibrated (calibrated=false at v1). Full verdict history is not shown on this page.

Own this server? Test a description on the public screen → It is a separate check from the verdict above, so the two can differ.

That verdict was true at screening time (snapshot 2026-11-04).

Contracts can change after screening, with no version bump. The gate pins io.github.cyanheads/inaturalist-mcp-server’s tool contracts on first sight and holds any silent change before your agent acts - the check that keeps being true on Tuesday.

See your first HOLD in 2 minutes →

Related: how to trust an MCP server · screen before install · silent contract drift

Contract drift · crawler-observed · ledger
10 contract changes observedmost recent Mon, 02 Nov 2026 04:00:00 GMTsafety-relevant diff

10 changes with a version change.

what changednew optional inputinput constraint tightenedoutput shape changed
injected context changedmost recent Tue, 27 Oct 2026 04:00:00 GMTsafety-relevant diff
what changedinjected server instructions changed

Server-scoped, not a tool: this is text the server supplies for clients to inject into an agent’s context on connect (instructions or prompt metadata). It sits outside every tool contract hash, so this observation is its only drift signal.

Part of a publisher-wide change of the same kind on 2026-11-02, seen on 10 servers from this publisher.

Part of a publisher-wide change of the same kind on 2026-11-02, seen on 18 servers from this publisher.

Part of a publisher-wide change to server context of the same kind on 2026-10-27, seen on 10 servers from this publisher.

Part of a publisher-wide change of the same kind on 2026-10-27, seen on 18 servers from this publisher.

Part of a publisher-wide change of the same kind on 2026-09-23, seen on 24 servers from this publisher.

Observed by mcpindex’s crawler between daily registry snapshots - a contract diff, not a safety verdict, and not an in-path prevention (that is the gate). A “safety-relevant diff” touches a safety-relevant field; it is not a confirmed vulnerability. Shown at the server level; individual tools are not named. Absence is not a clean bill of health: only public-registry servers are crawled.

Cite this record

People vet a server before wiring it in. One line on your project site or docs answers that with an independent record: screening verdict, registry provenance, contract drift history. It stays current as new screens and drift events land.

Markdown
[Independent trust record for io.github.cyanheads/inaturalist-mcp-server](https://mcpindex.ai/server/io-github-cyanheads-inaturalist-mcp-server) - screening verdict, registry provenance, and contract drift monitoring.
HTML
<a href="https://mcpindex.ai/server/io-github-cyanheads-inaturalist-mcp-server">Independent trust record for io.github.cyanheads/inaturalist-mcp-server</a> - screening verdict, registry provenance, and contract drift monitoring.
Embed this badge

A live verdict badge for your README or listing. It reflects the current screen, links back here, and updates when the verdict does.

Markdown
[![mcpindex](https://mcpindex.ai/api/v1/badge/io-github-cyanheads-inaturalist-mcp-server)](https://mcpindex.ai/server/io-github-cyanheads-inaturalist-mcp-server)
HTML
<a href="https://mcpindex.ai/server/io-github-cyanheads-inaturalist-mcp-server"><img src="https://mcpindex.ai/api/v1/badge/io-github-cyanheads-inaturalist-mcp-server" alt="mcpindex verdict" height="20" /></a>
Environment variables
MCP_LOG_LEVEL

Sets the minimum log level for output (e.g., 'debug', 'info', 'warn').

INATURALIST_CLAMP_LIMITS

Clamp oversized read limits and radius (20,040 km), and defer oversized by-id batches. Set false to restore strict rejection, including radius above 500 km.

INATURALIST_USER_AGENT

User-Agent sent on every request to api.inaturalist.org. Defaults to the package name, its version, and the repository URL. Keep a contact URL in any override — the published terms ask for identifiable clients.

INATURALIST_MIN_REQUEST_INTERVAL_MS

Minimum spacing between outbound request starts, in milliseconds. The default holds the sustained rate near 54 requests per minute, under the 60 the upstream asks for and well under its 100 ceiling.

INATURALIST_MAX_CONCURRENT_REQUESTS

Maximum outbound requests in flight. Separate from the start interval: spacing bounds the sustained rate, this bounds the burst so one slow call does not stall the lane.

INATURALIST_DAILY_REQUEST_BUDGET

Outbound requests allowed per UTC day, counted in-process. The default sits under the 10,000 per day the upstream asks for, and exhaustion fails loudly rather than degrading silently. The counter is per process and resets on restart.

MCP_TRANSPORT_TYPE

Selects the HTTP transport.

MCP_HTTP_HOST

The hostname for the HTTP server.

MCP_HTTP_PORT

The port to run the HTTP server on.

MCP_HTTP_ENDPOINT_PATH

The endpoint path for the MCP server.

MCP_AUTH_MODE

Authentication mode to use: 'none', 'jwt', or 'oauth'.

MCP_LOG_LEVEL

Sets the minimum log level for output (e.g., 'debug', 'info', 'warn').

INATURALIST_CLAMP_LIMITS

Clamp oversized read limits and radius (20,040 km), and defer oversized by-id batches. Set false to restore strict rejection, including radius above 500 km.

INATURALIST_USER_AGENT

User-Agent sent on every request to api.inaturalist.org. Defaults to the package name, its version, and the repository URL. Keep a contact URL in any override — the published terms ask for identifiable clients.

INATURALIST_MIN_REQUEST_INTERVAL_MS

Minimum spacing between outbound request starts, in milliseconds. The default holds the sustained rate near 54 requests per minute, under the 60 the upstream asks for and well under its 100 ceiling.

INATURALIST_MAX_CONCURRENT_REQUESTS

Maximum outbound requests in flight. Separate from the start interval: spacing bounds the sustained rate, this bounds the burst so one slow call does not stall the lane.

INATURALIST_DAILY_REQUEST_BUDGET

Outbound requests allowed per UTC day, counted in-process. The default sits under the 10,000 per day the upstream asks for, and exhaustion fails loudly rather than degrading silently. The counter is per process and resets on restart.

MCP quality score · maturity, not trust · methodology
freshness
25
completeness
10
installability
25
documentation
15
stability
5
Alternatives in Search