mcp.tapwatermap.com
Is the mcp.tapwatermap.com MCP server safe to use?
Independent trust grade A (93/100). No blocking issues found in the static + spec checks. wmcp.sh continuously watches mcp.tapwatermap.com for tool drift and rug-pulls. The grade is free and identical whether or not the operator pays.
What it offers — 10 tools · Search
searchSearch TapWaterMap for US cities by name. Returns matching cities with an id you can pass to `fetch`. (ChatGPT/Deep-Research compatible.)
fetchFetch the full plain-English EPA tap-water record for a city id (e.g. 'vt/burlington') returned by `search`. (ChatGPT/Deep-Research compatible.)
search_citiesFind covered US cities by name, optionally within a state. Returns counts + the page URL for each.
get_city_waterThe core tool: what the EPA has on record for a city's tap water — the active community water systems serving it, populations, sources, and violations
get_water_systemEPA record for a single water system by its PWSID (e.g. 'VT0005053'): name, population served, source, and violations.
list_state_citiesList all covered cities in a state (with violation counts).
find_citiesFilter/rank cities across the dataset — e.g. cities in TX with open health-based violations, or cities with a specific contaminant. Returns ranked mat
compare_citiesCompare the EPA records of several cities side by side. Pass cities as 'City, ST' strings.
explain_contaminantPlain-English explanation of an EPA contaminant by name or code: the EPA name, whether the EPA classifies it as health-based, and how often it appears
coverage_statsWhat TapWaterMap covers: states, cities, total EPA violation records, and the data quarter/date.
- ✓ initialize → protocolVersion 2025-06-18
- ✓ initialize HTTP 200
- ✓ unknown method → -32601
- ✓ tools/list → 10 tools
- ✓ every tool has name + inputSchema
- 10 tools scanned
- no injection markup
- no secret-path refs
- single-probe latency 94ms (PRELIMINARY — continuous uptime/p95 from proxy telemetry lands in v2)
- 90% of tools have typed inputSchema
- 0/10 declare outputSchema
- no unannotated destructive tools
- HTTPS ✓
- RFC 9728 oauth-protected-resource metadata ✓
- advertises protocol 2025-06-18
Observed behavior
No proxied traffic observed for this host yet. Connect it at /connect and its grade gains a measured Reliability score + per-tool behavioral evidence — the half a static scan can't produce.
Findings
We re-grade mcp.tapwatermap.com on a schedule and alert your Slack/webhook the moment its tools change or its grade drops — rug-pull insurance for the connection.
Run mcp.tapwatermap.com? Claim it (free) to get drift alerts and show an independently-verified trust badge. The grade stays free — claiming just ties it to you.
Share this report card
A 1200×630 card with the grade + audit — drop it in a post, Slack, or your repo.
Embed this grade
A live badge — it re-verifies itself and shows current stability. Static scorecards can't. Paste it in your README or site to show users you're independently audited.
[](https://wmcp.sh/mcp/grade/mcp.tapwatermap.com)
<a href="https://wmcp.sh/mcp/grade/mcp.tapwatermap.com"><img src="https://wmcp.sh/mcp/grade/mcp.tapwatermap.com/badge.svg" alt="MCP Trust Grade A · wmcp.sh"></a>
Agents: check this before connecting
Add the wmcp.sh trust oracle as an MCP server and call grade_mcp_server / check_mcp_drift in your agent's pre-connection gate:
https://wmcp.sh/mcp/trust
readOnly vs observed behavior) layer on via the wmcp.sh proxy.