faostat-mcp-server: Instructions file for Claude Code

Developer Protocol

Server: faostat-mcp-server Version: 0.2.3 Framework: @cyanheads/mcp-ts-core ^0.12.3 Engines: Bun ≥1.3.0, Node ≥24.0.0 MCP SDK: @modelcontextprotocol/server ^2.0.0 (via the framework) Zod: ^4.4.3

Read the framework docs first: node_modules/@cyanheads/mcp-ts-core/CLAUDE.md contains the full API reference — builders, Context, error codes, exports, patterns. This file covers server-specific conventions only.

---

What's Next?

When the user asks what's next or needs direction, suggest options based on the current project state. Common next steps:

1. Add tools — scaffold new definitions using the add-tool / add-app-tool skills
2. Add a domain to the mirror — extend FAOSTAT_DOMAINS, then re-sync (bun run mirror:refresh) so faostat_query_observations can read it
3. Add tests — scaffold tests for existing definitions using the add-test skill
4. Field-test definitions — exercise tools with real inputs using the field-test skill, get a report of issues and pain points
5. Run devcheck — lint, format, typecheck, and security audit
6. Run the security-pass skill — audit handlers for MCP-specific security gaps: output injection, scope blast radius, input sinks, tenant isolation
7. Run the polish-docs-meta skill — finalize README, CHANGELOG, metadata, and agent protocol for shipping
8. Run the maintenance skill — investigate changelogs, adopt upstream changes, and sync skills after bun update --latest

Tailor suggestions to what's actually missing or stale — don't recite the full list every time.

---

Core Rules

• Logic throws, framework catches. Tool handlers are pure — throw on failure, no try/catch. Plain Error is fine; the framework catches, classifies, and formats. Use the typed errors[] contract + ctx.fail() (or factories like notFound()) when the error code matters.
• Use ctx.log for request-scoped logging. No console calls (the mirror CLI scripts are the lone exception — they print progress to stdout outside a request).
• Use ctx.state for tenant-scoped storage. Never access persistence directly. The canvas staging layer resolves the session canvas from ctx.state.
• Secrets in env vars only — never hardcoded. (This server is keyless; there are no secrets to manage.)
• Carry the data-quality flag through. Every FAOSTAT observation has a flag (A/E/I/B/X). Never drop it from output or format() — it's load-bearing for downstream rigor.
• Aggregate exclusion is the safe default. faostat_query_observations excludes area codes ≥ 5000 (World/continents/groupings) unless include_aggregates: true, so a naive SUM doesn't double-count. Preserve this.
• Close the loop on issues. When implementing work tracked by a GitHub issue, comment on the issue with what landed and close it. Do both — a comment without a close leaves stale issues open; a close without a comment leaves no record of what shipped. The comment is for future readers — state the concrete changes, not the conversation that produced them.