CDT Express by Riskthinking.AI MCP server

CDT Express MCP Server

Interact with climate metrics through Riskthinking.AI's CDT Express API in supported AI chat experiences.

This project contains:

authorize with their VELO account.

• The core MCP server for the Riskthinking.AI CDT Express API.
• A remote Streamable HTTP server that users can connect to by URL and

GitHub releases.

• A distributable MCPB extension for Claude Desktop, published through

Remote MCP

Add this URL as a custom MCP server in a compatible AI app:

https://mcp.riskthinking.ai/mcp

The app opens VELO for sign-in or sign-up. After consent, authorization completes automatically: the CDT API key is provided to the MCP server through a server-to-server backchannel and is never shown to the AI app, browser URL, or MCP logs.

Gemini CLI can also connect to it as a Streamable HTTP MCP server.

• ChatGPT: enable Developer mode, create a custom app, and enter the URL.
• Claude web/desktop: add a custom connector using the URL.
• Gemini: eligible Gemini Spark users can add a custom app using the URL.

See the remote MCP live-testing guide for current platform requirements, setup steps, and acceptance checks.

The existing MCPB/stdio package remains available for local-only use.

Run the remote server

cp .env.example .env
# Set MCP_OAUTH_SECRET in .env to the output of: openssl rand -base64 48
npm ci
npm run build
npm run start:http

Alternatively, build and run the included Dockerfile. Production requires HTTPS at MCPPUBLICBASEURL. The Cloud Run disaster-recovery guide covers WIF/IAM provisioning, GitHub configuration, and Cloudflare DNS. Configure the visual-eyes deployment with CDTMCP_URL=https://mcp.riskthinking.ai/mcp so its /mcp/authorize route can complete the authenticated hand-off.

The HTTP server provides:

compatibility.

• Streamable HTTP at /mcp, with JSON responses for broad client

binding.

• OAuth protected-resource and authorization-server discovery.
• OAuth 2.1 authorization code flow with S256 PKCE and RFC 8707 resource

with public-IP-pinned fetching, redirect rejection, strict size/time limits, and dynamic client registration for backward compatibility.

• Client ID Metadata Documents (CIMD) for any standards-compliant HTTPS client,

no credential database required.

• One-hour encrypted access tokens and 30-day encrypted refresh tokens, with

metadata, bearer checks on every MCP request, per-authorization session binding, host/origin validation, and bounded request bodies.

• Exact callback validation against each client's registered or fetched

MCPOAUTHSECRET is the only durable secret and must be shared by all remote MCP instances. Rotating it invalidates existing client registrations and tokens. The current TypeScript SDK negotiates MCP through 2025-11-25, which the major hosted clients currently use. The endpoint is structured for the stateless 2026-07-28 transport and can switch when the stable TypeScript SDK exposes that protocol revision.

MCPB Extension Installation

Claude Desktop.

1. Download and install

GitHub releases page.

1. Download cdt-express.mcpb from the

VELO.

1. In Claude Desktop, open Settings > Extensions > Advanced settings.
2. Select Install Extension and choose the downloaded MCPB file.
3. When prompted, enter the CDT Express API key from

permissions can also be configured under Settings > Extensions.

1. Review and enable the extension, then close the preview.
2. On its first tool call, select Allow once or Always allow. Tool

To update the extension, install the newer MCPB file and select Update.

Roadmap

CDT Express Climate API:

Shortened. The full README is on GitHub.