
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
@pondlog/mcp-npn
Advanced tools
MCP server for the USA National Phenology Network (NPN). Eight tools for phenology data: species, stations, observations, site-level phenometrics, and a place-aware 'active phenology' helper. No API key required.
A place-aware USA National Phenology Network MCP server. Gives any MCP-aware AI client (Claude Desktop, Cursor, Continue, custom agents) eight tools for plant and animal phenology data: species catalog, stations, observations, site-level phenometrics, and a place-aware "what's active near me" shortcut.
No API key required. NPN is a public scientific dataset.
Part of pondlog, a toolkit for stitching together public nature APIs (iNaturalist, eBird, USGS, NPN, NOAA, SunCalc).
Phenology is the seasonal timing of biological events: first leaf, first bloom, first call, first migration. NPN volunteers and scientists record these events at thousands of stations across the US, building a multi-decade dataset used for tracking climate change, planning restoration, and understanding regional ecology.
The server is published to npm and runs via npx (no install step):
npx -y @pondlog/mcp-npn
It speaks MCP over stdio. The server is internally rate-limited (1 req/sec sustained, bursts to 5). Be polite; NPN doesn't publish a formal limit.
Edit ~/Library/Application Support/Claude/claude_desktop_config.json
(macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"pondlog-npn": {
"command": "npx",
"args": ["-y", "@pondlog/mcp-npn"]
}
}
}
Restart Claude Desktop. The eight tools will appear in the slash menu.
Edit ~/.cursor/mcp.json:
{
"mcpServers": {
"pondlog-npn": {
"command": "npx",
"args": ["-y", "@pondlog/mcp-npn"]
}
}
}
npx @modelcontextprotocol/inspector npx -y @pondlog/mcp-npn
All tools are read-only. Coordinates use WGS84 decimal degrees. State
codes are 2-letter US postal codes (WA, CA, NY).
| Tool | What it does |
|---|---|
search_species | Filter the ~1,900-species NPN catalog by name, genus, or kingdom. Returns NPN species_ids you can pass to other tools. |
get_stations_in_state | List NPN stations in a US state. Returns station_ids, names, coordinates. |
get_station_count_by_state | Quick map of NPN coverage: how many stations per state. |
get_stations_with_species | Find stations that have observed specific species. |
get_stations_by_location | Stations inside a WKT polygon. Use get_active_phenology_nearby for the lat/lng/radius shortcut. |
get_observations | Raw status/intensity records (was phenophase 'yes'/'no' on date). Requires year + ≥1 narrowing filter. Bandwidth-heavy. |
get_site_level_data | Per-site phenometric aggregates: mean first/last 'yes' date for each (site, species, phenophase). Best granularity for "when does X bloom here?" |
get_active_phenology_nearby | Place-aware shortcut: WKT bbox, stations, haversine, site-level data, sorted by most-recent activity. The headline tool. |
get_station_count_by_state first if you're not sure.get_stations_with_species.years_back: 2 to surface complete data.-9999 is NPN's null sentinel. Tools translate this to undefined so you never see it in responses.After configuring, try:
get_active_phenology_nearby first. It composes the multi-step lookup (WKT, stations, site-level data) so you don't have to.get_site_level_data with state filter. Returns mean first/last yes dates per phenophase.get_observations without species filtering. Single station-year results can be 80+ MB.Result<T>-style envelope. Success returns { ok: true, data }; error returns isError: true with structured { ok: false, error: { source, message, statusCode? } }.MIT. See the root LICENSE.
FAQs
MCP server for the USA National Phenology Network (NPN). Eight tools for phenology data: species, stations, observations, site-level phenometrics, and a place-aware 'active phenology' helper. No API key required.
We found that @pondlog/mcp-npn demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.